PHP: md5('240610708') == md5('QNKCDZO') • Hacker News Board

Re: PHP: md5('240610708') == md5('QNKCDZO')

#71

Post by FeepingCreature » Mon, May 04, 2015, 11:33 AM UTC

sarciszewski wrote: post #68

DoubleMalt wrote: post #54

Earlier quoted context omitted.

Once I wrote a little PHP application to manage a clan in a browser game. I used an MD5 hash as session id that I checked with if(session_id) When users started reporting that their logins would sometimes not work at the first time, I found out that strings that start with zero are coerced to 0 and then interpreted as false. Never used PHP for anything important since.

> I used an MD5 hash as session id > Never used PHP for anything important since. The problem here isn't PHP, the problem here is you.

Nah, the problem is PHP.

See: http://blog.codinghorror.com/falling-into-the-pit-of-success...

> When you write code in [PHP], you're always circling the pit of despair, just one misstep away from plunging to your doom.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#72

Post by jrockway » Mon, May 04, 2015, 11:35 AM UTC

sarciszewski wrote: post #68

DoubleMalt wrote: post #54

Earlier quoted context omitted.

Once I wrote a little PHP application to manage a clan in a browser game. I used an MD5 hash as session id that I checked with if(session_id) When users started reporting that their logins would sometimes not work at the first time, I found out that strings that start with zero are coerced to 0 and then interpreted as false. Never used PHP for anything important since.

> I used an MD5 hash as session id > Never used PHP for anything important since. The problem here isn't PHP, the problem here is you.

I didn't hear him blaming PHP. Defensive, are we?

Re: PHP: md5('240610708') == md5('QNKCDZO')

#73

Post by beched » Mon, May 04, 2015, 11:45 AM UTC

Here's a threaded app for finding such collisions: https://github.com/beched/php_hash_collision_finder

Re: PHP: md5('240610708') == md5('QNKCDZO')

#74

Post by rimantas » Mon, May 04, 2015, 11:50 AM UTC

VMG wrote: post #40

dietrichepp wrote: post #6

I'm not exactly clear on how PHP == works, but you can see the MD5 for yourself: $ echo -n 240610708 | md5sum 0e462097431906509019562988736854 - $ echo -n QNKCDZO | md5sum 0e830400451993494058024219903391 - $ echo -n aabg7XSs | md5sum 0e087386482136013740957780965295 - All of them start with 0e, which makes me think that they're being parsed as floats and getting converted to 0.0. This is why "magic" operators like =…

Same goes for the `0E` prefix with an uppercase E The likelihood of generating a hash value with that kind of prefix is 2 in 65536. Finding a collision `hash(a) == hash(b)` with this "weak" equality comparison is approximately 1 in 256 if I'm not mistaken.

From the manual:

  > The value is given by the initial portion of the string.
  > If the string starts   with valid numeric data, this will
  > be the value used. Otherwise, the value will be 0 (zero).
  > Valid numeric data is an optional sign, followed by one
  > or more digits (optionally containing a decimal point),
  > followed by an optional exponent. The exponent is an 'e'
  > or 'E' followed by one or more digits.

Also:

  > If you compare a number with a string or the comparison
  > involves numerical strings, then each string is converted
  > to a number and the comparison performed numerically.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#75

Post by userbinator » Mon, May 04, 2015, 12:07 PM UTC

tragomaskhalos wrote: post #63

shubhamjain wrote: post #14

PHP's type coercion is nothing like I have every seen in any other language. Its horrendously messy, ugly and completely inexcusable. Strings type-casted to integers are 0. Seriously? Take a look at this, > $arr = array(0, "was", "invented", "in", "india"); > var_dump( in_array("Hello", $arr ) ); and yeah it is TRUE because "Hello" got coerced to 0. I blogged about a major bug, I faced, in PHP, where column name "10t…

There are a couple of things we have learnt in our collective 50+ years of software engineering: 1. Code is not English: Nice try COBOL, and someone had to try, but a failed experiment. Bizarre holdouts: SQL 2. People are not idiots, and will not collapse into a gibbering heap if their programming language insists that 0 and "0" are different things and must be managed accordingly. Bizarre holdouts: PHP, Javascript.…

Bizarre holdouts: SQL

I think SQL is actually one of the better implementations of this idea. It's a bit verbose, but I don't think it's tripped up people in the same way that PHP and JS do.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#76

Post by FractalNerve » Mon, May 04, 2015, 12:07 PM UTC

dietrichepp wrote: post #6

I'm not exactly clear on how PHP == works, but you can see the MD5 for yourself: $ echo -n 240610708 | md5sum 0e462097431906509019562988736854 - $ echo -n QNKCDZO | md5sum 0e830400451993494058024219903391 - $ echo -n aabg7XSs | md5sum 0e087386482136013740957780965295 - All of them start with 0e, which makes me think that they're being parsed as floats and getting converted to 0.0. This is why "magic" operators like =…

I tried replacing == with === and it gave me bool(false) in all cases.

Here's the code: http://3v4l.org/15hr7

Re: PHP: md5('240610708') == md5('QNKCDZO')

#77

Post by steego » Mon, May 04, 2015, 12:08 PM UTC

tellor wrote: post #69

This is well-known PHP-trick. Use === to right result. php > var_dump(md5('240610708') == md5('QNKCDZO')); bool(true) php > var_dump(md5('240610708'), md5('QNKCDZO')); string(32) "0e462097431906509019562988736854" string(32) "0e830400451993494058024219903391" php > var_dump(md5('240610708') === md5('QNKCDZO')); bool(false) php > var_dump("0e462097431906509019562988736854" == "0e830400451993494058024219903391"); bool(…

> This is well-known PHP-trick. Use === to right result.

Everybody knows PHP is a trickly-typed language. Read the docs people or PHP will take advantage of your gullible ass.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#78

Post by roblfrieburg » Mon, May 04, 2015, 12:11 PM UTC

jrockway wrote: post #72

sarciszewski wrote: post #68

Earlier quoted context omitted.

> I used an MD5 hash as session id > Never used PHP for anything important since. The problem here isn't PHP, the problem here is you.

I didn't hear him blaming PHP. Defensive, are we?

He didn't blame PHP, just never used it again for anything important. Did we read the same comment?

Re: PHP: md5('240610708') == md5('QNKCDZO')

#79

Post by WalterGR » Mon, May 04, 2015, 12:13 PM UTC

eurleif wrote: post #51

WalterGR wrote: post #45

Earlier quoted context omitted.

Actually, I was hoping for something more than a single example. Or, did you mean that PHP and JavaScript were neck-and-neck all the way up to that one example, and ultimately it's the very one that proves PHP's type coercion is worse?

You're in a thread about how PHP's type coercion can easily cause a serious vulnerability. So, the title of this thread is your second example. If you want a third example, find it yourself.

Give me a break. 3 examples isn't enough to answer the question. Your comment history shows you ask questions in lieu of doing your own research. If you don't want to take the time, then move on.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#80

Post by imakesnowflakes » Mon, May 04, 2015, 12:17 PM UTC

rimantas wrote: post #67

DoubleMalt wrote: post #54

Earlier quoted context omitted.

Once I wrote a little PHP application to manage a clan in a browser game. I used an MD5 hash as session id that I checked with if(session_id) When users started reporting that their logins would sometimes not work at the first time, I found out that strings that start with zero are coerced to 0 and then interpreted as false. Never used PHP for anything important since.

Yeah, documentation is for pussies.

Here is one PHP core developer claiming that PHP documentation is wrong, even on fundamental things...

http://www.reddit.com/r/lolphp/comments/2md8c0/new_safe_cast...

Just saying....