Yes md5 is broken. We've known this for quite some time.
This has nothing to do with md5 itself.
PHP: md5('240610708') == md5('QNKCDZO')
31–40 of 185 posts
Re: PHP: md5('240610708') == md5('QNKCDZO')
#32PHP's == has a lot of oddball effects. They were put in so that things would behave the way a novice expects them to (3 == '3') but would confuse more experienced programmers, or those coming from other languages. Unless you're deliberately taking advantage of automatic type conversion and whatnot, you should probably use === by default.
> you should probably use === by default. unfortunately this can also backfire if your class/module is used in a different context where it gets strings instead of integers and you were just using === without really thinking about it: We had a case where the code was something like: function doSomething($value) { if ($value === 0) { //do something } else { //do something else } } This was then used in a slighly diffe…
[deleted]
Re: PHP: md5('240610708') == md5('QNKCDZO')
#33(Shameless plug) http://blog.hackensplat.com/2012/04/php-some-strings-are-mor... At which point in this article do I start making stuff up about PHP's comparison operators?
> If you want to compare two strings that are the same except they each use different ways of expressing an 'é', you need to add another equal sign and use ==== to differentiate them, as === will see them as equal.
Re: PHP: md5('240610708') == md5('QNKCDZO')
#34PHP's == has a lot of oddball effects. They were put in so that things would behave the way a novice expects them to (3 == '3') but would confuse more experienced programmers, or those coming from other languages. Unless you're deliberately taking advantage of automatic type conversion and whatnot, you should probably use === by default.
> you should probably use === by default. unfortunately this can also backfire if your class/module is used in a different context where it gets strings instead of integers and you were just using === without really thinking about it: We had a case where the code was something like: function doSomething($value) { if ($value === 0) { //do something } else { //do something else } } This was then used in a slighly diffe…
You're describing the expected behavior of === and a bug.
This is not the === operator "backfiring."
Re: PHP: md5('240610708') == md5('QNKCDZO')
#35I'm not exactly clear on how PHP == works, but you can see the MD5 for yourself: $ echo -n 240610708 | md5sum 0e462097431906509019562988736854 - $ echo -n QNKCDZO | md5sum 0e830400451993494058024219903391 - $ echo -n aabg7XSs | md5sum 0e087386482136013740957780965295 - All of them start with 0e, which makes me think that they're being parsed as floats and getting converted to 0.0. This is why "magic" operators like =…
This, combined with the fact that you can increment strings gives some 'interesting' results: $a = "2d9"; $a++; echo $a . "\n"; $a++; echo $a . "\n"; Output 2e0 3
This is wonderful, I love it!
Interestingly [1], this echoes "2e0" followed by "3" in hhvm-3.7.0, but "3" followed by "4" in hhvm-3.6.0.
Re: PHP: md5('240610708') == md5('QNKCDZO')
#36PHP's type coercion is nothing like I have every seen in any other language. Its horrendously messy, ugly and completely inexcusable. Strings type-casted to integers are 0. Seriously? Take a look at this, > $arr = array(0, "was", "invented", "in", "india"); > var_dump( in_array("Hello", $arr ) ); and yeah it is TRUE because "Hello" got coerced to 0. I blogged about a major bug, I faced, in PHP, where column name "10t…
PHP's type coercion is nothing like I have
every seen in any other language. Its
horrendously messy, ugly and completely
inexcusable.
Re: PHP: md5('240610708') == md5('QNKCDZO')
#37All of this I can understand, but why then octal numbers are not compared the same way is beyond me?
var_dump(0xA == '0xA'); // bool(true)
var_dump(012 == '012'); // bool(false)Re: PHP: md5('240610708') == md5('QNKCDZO')
#38PHP's type coercion is nothing like I have every seen in any other language. Its horrendously messy, ugly and completely inexcusable. Strings type-casted to integers are 0. Seriously? Take a look at this, > $arr = array(0, "was", "invented", "in", "india"); > var_dump( in_array("Hello", $arr ) ); and yeah it is TRUE because "Hello" got coerced to 0. I blogged about a major bug, I faced, in PHP, where column name "10t…
PHP's type coercion is nothing like I have every seen in any other language. Its horrendously messy, ugly and completely inexcusable. Is it objectively worse than type coercion in JavaScript?
PHP: var_export(0 == "hello"); // true
JavaScript: console.log(0 == "hello"); // false
Re: PHP: md5('240610708') == md5('QNKCDZO')
#39PHP's type coercion is nothing like I have every seen in any other language. Its horrendously messy, ugly and completely inexcusable. Strings type-casted to integers are 0. Seriously? Take a look at this, > $arr = array(0, "was", "invented", "in", "india"); > var_dump( in_array("Hello", $arr ) ); and yeah it is TRUE because "Hello" got coerced to 0. I blogged about a major bug, I faced, in PHP, where column name "10t…
> in_array(.., .., $strict) I think you're aware of the third parameter but for anyone who reads this post, it disables the type coercion of the in_array call.
Spoiling a good rant with facts.
Re: PHP: md5('240610708') == md5('QNKCDZO')
#40I'm not exactly clear on how PHP == works, but you can see the MD5 for yourself: $ echo -n 240610708 | md5sum 0e462097431906509019562988736854 - $ echo -n QNKCDZO | md5sum 0e830400451993494058024219903391 - $ echo -n aabg7XSs | md5sum 0e087386482136013740957780965295 - All of them start with 0e, which makes me think that they're being parsed as floats and getting converted to 0.0. This is why "magic" operators like =…
Same goes for the `0E` prefix with an uppercase E
The likelihood of generating a hash value with that kind of prefix is 2 in 65536.
Finding a collision `hash(a) == hash(b)` with this "weak" equality comparison is approximately 1 in 256 if I'm not mistaken.