Who's checking if a string matches "null" rather than is null!?
So... very often.
> In most cases, it's not your system, though
You can’t pick and chose whether you own a system or not when presented with an opposing argument. That’s not how this works.
"System owner, we need to spend $10K to clean up the database and code so that null and "null" are not the same thing, even though it works 99.99% of the time".
Do you see the difference?
You can waste 10k paying someone to look at it or you could not waste your money, but I’d be fucked before I sign off on a system with those kinds of bugs as being secure, evidence or not. Someone higher up can accept that risk, but I’d rather not be liable when it’s breached or catastrophically damaged because some kid changed their last name to an SQL injection payload.
And yes, I’ve checked, in my country unpronounceable names are not permitted, otherwise I’d have one. There are existing case studies of this, iirc in the UK.
Note that when interpolated into SQL, the contents of $var must be surrounded by single quotes, so you end up with `insert into Table (Name) values ('Null')`, which correctly inserts the string "Null" into the table.
If you were to leave off the quotes, you'd get a SQL syntax error for all other people, so that code would never make it into production. E.g. `insert into Table (Name) values (Smith)` is a syntax error.
> $db.exec($req)
Now you have "null" as strings in the DB in any language that interpolates null as "null".
> select * from people where name is not null
"Why do we see nulls in testing? Damn, the DB has dirty data. Go through the trouble of fixing it, or...
> select * from people where name is not null and name != "null"
The end. Sorry Mr Null.
I think you underestimate how many systems are stringly-typed, not just in terms of problematic programming languages, but data traveling between different APIs or through literal dead-tree paperwork.
They don't have to all fail at null handling, just one or two can gum up the works.
For example, some will prefer to use `null` to mean that a value is _intentionally_ missing (for example, the db explicitly returned a null value), while `undefined` does not have any such connotation. These exist for frontend engineers to navigate decisions often far removed from their influence.
Anyway, `null != ''` and `null != 'null'`, but `null == undefined`. However, `null !== undefined`.
A lot has been made of js Truthy/Falsy equality operator, but most js programmers will take steps to actively avoid it coming into play. Probably the `void` operator is still under-used though in frontend code, though, since there's some pretty surprising legacy things that can happen when interacting with DOM APIs (like `checkbox.onclick = () => doSomething()` resulting in different checkbox behavior depending on whether or not `doSomething` returns a boolean or undefined).
I wonder if I could legally define my middle name as starting with a lowercase letter.
<?php
if ("null" == null) { echo "true"; } else { echo "false"; }
prints "false"
Well... it does, but that would just be an empty string.
So you absolutely could store null in a string... It is even a valid ascii and UTF character. Now most string handling functions treat it as the end of a string in C but that is only by convention.
How you would display null to a user is a different story all together but representing it in a string is not an unsolved programming problem, generally its when you need to actually display null that it becomes a hard problem because how do you display the absence of something, specifically when a space is not an absence.
How do you serialise a string... Well it's already serialised given your specific endianness... So you just indicate that... This is 280 bytes of UTF8 data... It can contain as many nulls as you like, until you get 280 bytes of data you don't have all of it.
Since in C strings are quasi-arrays and arrays are quasi-pointers there is probably a way to use a null pointer, but this would be a local convention for getting around C's lack of native support for null values. You couldn't expect it to be supported by utilities or libraries.
20 years later and multiple systems depending on each others, random hidden CRONs in the middle and now people called Null have a problem.