Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHP: md5('240610708') == md5('QNKCDZO')

3v4l.org

Post reply on HN
Print view View original

101–110 of 185 posts

Re: PHP: md5('240610708') == md5('QNKCDZO')

#101

Post by protomyth »

dietrichepp wrote: post #6

I'm not exactly clear on how PHP == works, but you can see the MD5 for yourself: $ echo -n 240610708 | md5sum 0e462097431906509019562988736854 - $ echo -n QNKCDZO | md5sum 0e830400451993494058024219903391 - $ echo -n aabg7XSs | md5sum 0e087386482136013740957780965295 - All of them start with 0e, which makes me think that they're being parsed as floats and getting converted to 0.0. This is why "magic" operators like =…

So, you should use the old shell trick of adding an "X" to the front of the strings before comparing?

Re: PHP: md5('240610708') == md5('QNKCDZO')

#102

Post by picks_at_nits »

codeinchaos wrote: post #91
imakesnowflakes wrote: post #86

Earlier quoted context omitted.

You bought a new car. You took it out for a ride. a tree falls before you. You brake, but the car proceeded to hit the tree anyway. You call the car company and talk to their engineers. One of them ask. 'Did this happen on a Friday evening, when it was raining?' You say 'Yes, how do you know?' The engineer replies. "Our brakes does not work on rainy Friday evenings. If you REALLY want to brake on a rainy Friday eveni…

sure, everything should be done perfectly or not at all ...

We can accept that perfection may be impossible, difficult to obtain, or a poor tradeoff against other factors.

But that doesn’t mean that all imperfect designs are of equal merit.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#103

Post by jlouis »

lars wrote: post #16
dietrichepp wrote: post #6

I'm not exactly clear on how PHP == works, but you can see the MD5 for yourself: $ echo -n 240610708 | md5sum 0e462097431906509019562988736854 - $ echo -n QNKCDZO | md5sum 0e830400451993494058024219903391 - $ echo -n aabg7XSs | md5sum 0e087386482136013740957780965295 - All of them start with 0e, which makes me think that they're being parsed as floats and getting converted to 0.0. This is why "magic" operators like =…

This, combined with the fact that you can increment strings gives some 'interesting' results: $a = "2d9"; $a++; echo $a . "\n"; $a++; echo $a . "\n"; Output 2e0 3

There is some nasty type conversion going on here, from the type of stochastic random throws of two nine-sided dice to floats to integers. Where is your type preservation, PHP?

Re: PHP: md5('240610708') == md5('QNKCDZO')

#104

Post by jlouis »

lars wrote: post #16
dietrichepp wrote: post #6

I'm not exactly clear on how PHP == works, but you can see the MD5 for yourself: $ echo -n 240610708 | md5sum 0e462097431906509019562988736854 - $ echo -n QNKCDZO | md5sum 0e830400451993494058024219903391 - $ echo -n aabg7XSs | md5sum 0e087386482136013740957780965295 - All of them start with 0e, which makes me think that they're being parsed as floats and getting converted to 0.0. This is why "magic" operators like =…

This, combined with the fact that you can increment strings gives some 'interesting' results: $a = "2d9"; $a++; echo $a . "\n"; $a++; echo $a . "\n"; Output 2e0 3

There is some nasty type conversion going on here, from the type of stochastic random throws of two nine-sided dice to floats to integers. Where is your type preservation, PHP?

Re: PHP: md5('240610708') == md5('QNKCDZO')

#105

Post by nathanb »

sarciszewski wrote: post #70
Meekro wrote: post #5

PHP's == has a lot of oddball effects. They were put in so that things would behave the way a novice expects them to (3 == '3') but would confuse more experienced programmers, or those coming from other languages. Unless you're deliberately taking advantage of automatic type conversion and whatnot, you should probably use === by default.

And in C we can do this to get TRUE: return (33 == '3'); :P

Incorrect. However, (0x33 == '3') will return true, as will (51 == '3'). Your point is valid, even if your code is wrong. Automatic type coercion can produce unexpected results in any language.

PHP's automatic type coercion rules are designed to help newbies at the expense of experienced developers. C's automatic type coercion rules are, largely, designed to expose the underlying memory layout to developers who know what they're doing, at the expense of inexperienced developers. Both can easily contain dangerous pitfalls, but I prefer the latter philosophy over the former.

(Disclaimer: I have built a career as a C programmer and frequently use its lower-level features to great advantage. I am biased.)

Re: PHP: md5('240610708') == md5('QNKCDZO')

#106

Post by spaze »

dbrgn wrote: post #2

Just to make it clear, I did not come up with this example. Unfortunately I can't find out the source anymore. It also contained some technical explanations about why this works. So if anyone remembers, I'd be happy if you could comment with the link.

Author of the original tweet here, thanks for sharing! Here's the link to the "original original" MD5 tweet https://twitter.com/spazef0rze/status/439352552443084800

For similar tricks for SHA-1 and plaintext see https://twitter.com/spazef0rze/status/523010190900469760

Re: PHP: md5('240610708') == md5('QNKCDZO')

#107

Post by wmil »

ams6110 wrote: post #98
DoubleMalt wrote: post #54

Earlier quoted context omitted.

Once I wrote a little PHP application to manage a clan in a browser game. I used an MD5 hash as session id that I checked with if(session_id) When users started reporting that their logins would sometimes not work at the first time, I found out that strings that start with zero are coerced to 0 and then interpreted as false. Never used PHP for anything important since.

To be fair, this kind of thing (maybe not exactly this, but type-coercion bugs) can happen in JavaScript, which is all the rage now for "important" stuff.

It can happen in a few languages, but PHP is notably more aggressive in trying to convert to int.

Actually a common way to grief new websites is to try to register '0' as a username. `if (string)` is a common way to check for null, and '0' will often fail.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#108

Post by Killswitch »

Schlaefer wrote: post #92
TeMPOraL wrote: post #64

Earlier quoted context omitted.

> They were put in so that things would behave the way a novice expects them to (3 == '3') It's a very wrong approach. It may look like newbie-friendly, but in fact it makes it much harder to learn and use. Any novice will be constantly attempting to form a mental model of what's going on and how the language interprets concepts. Refusing to do things like 3 == '3' is simple and makes sense. Assuming a programmer is…

It's hard for newbies who want to master the language. It's not hard for people who have no interest in learning a programming language and just wan't to make the thingy in their HTML do some stuff. Register globals, and be done. We have to remember the PHP origins and audience from way back to understand why this was considered easy to use.

shhhhh, people don't realize PHP started out as just a tool for Rasmus and ended up evolving. No, to them, PHP was DESIGNED this way on purpose from the ground up.
Post reply on HN