Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHP: md5('240610708') == md5('QNKCDZO')

3v4l.org

Post reply on HN
Print view View original

91–100 of 185 posts

Re: PHP: md5('240610708') == md5('QNKCDZO')

#91

Post by codeinchaos »

imakesnowflakes wrote: post #86
sarciszewski wrote: post #68

Earlier quoted context omitted.

> I used an MD5 hash as session id > Never used PHP for anything important since. The problem here isn't PHP, the problem here is you.

You bought a new car. You took it out for a ride. a tree falls before you. You brake, but the car proceeded to hit the tree anyway. You call the car company and talk to their engineers. One of them ask. 'Did this happen on a Friday evening, when it was raining?' You say 'Yes, how do you know?' The engineer replies. "Our brakes does not work on rainy Friday evenings. If you REALLY want to brake on a rainy Friday eveni…

sure, everything should be done perfectly or not at all ...

Re: PHP: md5('240610708') == md5('QNKCDZO')

#92

Post by Schlaefer »

TeMPOraL wrote: post #64
Meekro wrote: post #5

PHP's == has a lot of oddball effects. They were put in so that things would behave the way a novice expects them to (3 == '3') but would confuse more experienced programmers, or those coming from other languages. Unless you're deliberately taking advantage of automatic type conversion and whatnot, you should probably use === by default.

> They were put in so that things would behave the way a novice expects them to (3 == '3') It's a very wrong approach. It may look like newbie-friendly, but in fact it makes it much harder to learn and use. Any novice will be constantly attempting to form a mental model of what's going on and how the language interprets concepts. Refusing to do things like 3 == '3' is simple and makes sense. Assuming a programmer is…

It's hard for newbies who want to master the language. It's not hard for people who have no interest in learning a programming language and just wan't to make the thingy in their HTML do some stuff.

Register globals,
and be done.

We have to remember the PHP origins and audience from way back to understand why this was considered easy to use.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#93

Post by aikah »

tragomaskhalos wrote: post #63
shubhamjain wrote: post #14

PHP's type coercion is nothing like I have every seen in any other language. Its horrendously messy, ugly and completely inexcusable. Strings type-casted to integers are 0. Seriously? Take a look at this, > $arr = array(0, "was", "invented", "in", "india"); > var_dump( in_array("Hello", $arr ) ); and yeah it is TRUE because "Hello" got coerced to 0. I blogged about a major bug, I faced, in PHP, where column name "10t…

There are a couple of things we have learnt in our collective 50+ years of software engineering: 1. Code is not English: Nice try COBOL, and someone had to try, but a failed experiment. Bizarre holdouts: SQL 2. People are not idiots, and will not collapse into a gibbering heap if their programming language insists that 0 and "0" are different things and must be managed accordingly. Bizarre holdouts: PHP, Javascript.…

Absolutely, to be fair to JS, Eich admitted it was an horrible mistake, and tools like JSlint enforce the use of === .

I didn't see any meaculpa from the PHP team yet.Would like to read about it.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#94

Post by josteink »

vog wrote: post #41

As a rough generalization, all PHP code that involves "==" and "!=" should be considered broken. PHP introduced "===" and "!==" a long time ago, and every programmer should know that they have to use that, without any excuses. Also, don't use "in_array($a, $b)", but use "in_array($a, $b, true)" instead.

So what you're basically saying is that the "standard" variations and APIs which people will find and use are broken, and the ones actually working are hidden somewhere in the documentation. And you're saying you think this is just fine?

In that case, I have a hammer to sell you, and I think you know which one.

http://blog.codinghorror.com/the-php-singularity/

Re: PHP: md5('240610708') == md5('QNKCDZO')

#95

Post by daenney »

shubhamjain wrote: post #14

PHP's type coercion is nothing like I have every seen in any other language. Its horrendously messy, ugly and completely inexcusable. Strings type-casted to integers are 0. Seriously? Take a look at this, > $arr = array(0, "was", "invented", "in", "india"); > var_dump( in_array("Hello", $arr ) ); and yeah it is TRUE because "Hello" got coerced to 0. I blogged about a major bug, I faced, in PHP, where column name "10t…

Amusingly enough the Puppet current parser does this too because it has some weird form of type juggling. This has been fixed in the future parser, which actually has a type system too :).

Re: PHP: md5('240610708') == md5('QNKCDZO')

#96

Post by kyllo »

dietrichepp wrote: post #6

I'm not exactly clear on how PHP == works, but you can see the MD5 for yourself: $ echo -n 240610708 | md5sum 0e462097431906509019562988736854 - $ echo -n QNKCDZO | md5sum 0e830400451993494058024219903391 - $ echo -n aabg7XSs | md5sum 0e087386482136013740957780965295 - All of them start with 0e, which makes me think that they're being parsed as floats and getting converted to 0.0. This is why "magic" operators like =…

Ahh PHP, the language where true == false

    php > if ((true == "foo") && ("foo" == 0) && (0 == false)) echo "yay!";
    yay!

Re: PHP: md5('240610708') == md5('QNKCDZO')

#98

Post by ams6110 »

DoubleMalt wrote: post #54
dietrichepp wrote: post #6

I'm not exactly clear on how PHP == works, but you can see the MD5 for yourself: $ echo -n 240610708 | md5sum 0e462097431906509019562988736854 - $ echo -n QNKCDZO | md5sum 0e830400451993494058024219903391 - $ echo -n aabg7XSs | md5sum 0e087386482136013740957780965295 - All of them start with 0e, which makes me think that they're being parsed as floats and getting converted to 0.0. This is why "magic" operators like =…

Once I wrote a little PHP application to manage a clan in a browser game. I used an MD5 hash as session id that I checked with if(session_id) When users started reporting that their logins would sometimes not work at the first time, I found out that strings that start with zero are coerced to 0 and then interpreted as false. Never used PHP for anything important since.

To be fair, this kind of thing (maybe not exactly this, but type-coercion bugs) can happen in JavaScript, which is all the rage now for "important" stuff.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#99

Post by tehwalrus »

userbinator wrote: post #75
tragomaskhalos wrote: post #63

Earlier quoted context omitted.

There are a couple of things we have learnt in our collective 50+ years of software engineering: 1. Code is not English: Nice try COBOL, and someone had to try, but a failed experiment. Bizarre holdouts: SQL 2. People are not idiots, and will not collapse into a gibbering heap if their programming language insists that 0 and "0" are different things and must be managed accordingly. Bizarre holdouts: PHP, Javascript.…

Bizarre holdouts: SQL I think SQL is actually one of the better implementations of this idea. It's a bit verbose, but I don't think it's tripped up people in the same way that PHP and JS do.

SQL is great for a very specific job: talking to a database. If you try to do anything else in it, you end up in a horrible mess (e.g. cursors).

Luckily, people rarely try to do anything difficult in SQL, because they are using another language and dropping into SQL to talk to their database. This can lead to inefficient code, depending on the API/SQL engine, but it means people end up with sane code (unless their other language is PHP, of course.)

Re: PHP: md5('240610708') == md5('QNKCDZO')

#100

Post by ejcx »

One thing to note.

The md5 and sha1 interfaces have a second param which prevents this bug.

Instead of returning a string it will return binary data which won't get coerced to a float.

For example:
PHP has a lot of.....PHPisms.
Post reply on HN