PHP: md5('240610708') == md5('QNKCDZO') • Hacker News Board

Re: PHP: md5('240610708') == md5('QNKCDZO')

#131

Post by Schlaefer » Mon, May 04, 2015, 2:52 PM UTC

tormeh wrote: post #113

Schlaefer wrote: post #92

Earlier quoted context omitted.

It's hard for newbies who want to master the language. It's not hard for people who have no interest in learning a programming language and just wan't to make the thingy in their HTML do some stuff. Register globals, and be done. We have to remember the PHP origins and audience from way back to understand why this was considered easy to use.

That's actually interesting. It's not obvious to me that "2" should be parsed as an int and not a string. Perhaps we should either be explicit about what we want "2" to be parsed as (int, long, float, double, bigint, bigfloat, string...) or let the parsing of a number be determined in a more dynamic way. If you're comparing a string with an integer literal, then you probably want the string interpretation of the lite…

We are pretty sure what the literals mean. On the other hand we have many string channels: get/post/cookie/persistent storage¹/… Given that environment its probably natural that you try to convert a string into its "intended" type.

¹no DB, but the "just write your visitor counter into a plain text file" back then

Re: PHP: md5('240610708') == md5('QNKCDZO')

#132

Post by devy » Mon, May 04, 2015, 2:52 PM UTC

The fact that PHP is a dynamic language and that "==" would automatically convert the types of both ends to a flat because of the "0e" prefix of the string is problematic. Perhaps it's a bug in the PHP source code.

See below.

		# the examples were essentially similar like this comparison.
		php > var_dump("0e462097431906509019562988736854" == "0e830400451993494058024219903391");
		bool(true)

		# md5() does return a string type, but just happens to start with "0e"
		php > var_dump(md5('240610708'));
		string(32) "0e462097431906509019562988736854"
		php > var_dump(md5('QNKCDZO'));
		string(32) "0e830400451993494058024219903391"

		# and if PHP treats them as floats instead of strings, they all evaluated to the same thing. float(0)
		php > var_dump(0e462097431906509019562988736854);
		float(0)
		php > var_dump(0e830400451993494058024219903391);
		float(0)
		php > var_dump(0e087386482136013740957780965295);
		float(0)

Re: PHP: md5('240610708') == md5('QNKCDZO')

#133

Post by eropple » Mon, May 04, 2015, 2:55 PM UTC

Killswitch wrote: post #108

Schlaefer wrote: post #92

Earlier quoted context omitted.

It's hard for newbies who want to master the language. It's not hard for people who have no interest in learning a programming language and just wan't to make the thingy in their HTML do some stuff. Register globals, and be done. We have to remember the PHP origins and audience from way back to understand why this was considered easy to use.

shhhhh, people don't realize PHP started out as just a tool for Rasmus and ended up evolving. No, to them, PHP was DESIGNED this way on purpose from the ground up.

Do you consider that an acceptable excuse for its behaviors fifteen years after the fact? Because I do not.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#134

Post by BasDirks » Mon, May 04, 2015, 2:57 PM UTC

Navarr wrote: post #122

FeepingCreature wrote: post #71

Earlier quoted context omitted.

Nah, the problem is PHP. See: http://blog.codinghorror.com/falling-into-the-pit-of-success... > When you write code in [PHP], you're always circling the pit of despair, just one misstep away from plunging to your doom.

I'd be willing to say this is true for any language in varying ways.

And what is gained from doing so? We must remain critical.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#135

Post by mykhal » Mon, May 04, 2015, 2:58 PM UTC

ccannon wrote: post #28

Yes md5 is broken. We've known this for quite some time.

it's not _that_ broken

Re: PHP: md5('240610708') == md5('QNKCDZO')

#136

Post by Nemcue » Mon, May 04, 2015, 3:00 PM UTC

Navarr wrote: post #123

jakcst wrote: post #116

Earlier quoted context omitted.

This truly just bummed me out :(

Don't let it - he understands exactly how the types are being converted in order to make it appear that true == false. This sort of thing happens in type conversion languages. You can either use === to stop conversion or you can understand how conversion works. I'm not sure how the order of conversions is decided by PHP, but here's a brief explanation: Compare "foo" to true. Convert the string "foo" to a boolean valu…

"This sort of thing happens in type conversion languages. You can either use === to stop conversion or you can understand how conversion works."

Even JavaScript isn't insane enough to somehow coerce a string to 0.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#137

Post by digitalzombie » Mon, May 04, 2015, 3:04 PM UTC

Someone1234 wrote: post #119

lars wrote: post #16

Earlier quoted context omitted.

This, combined with the fact that you can increment strings gives some 'interesting' results: $a = "2d9"; $a++; echo $a . "\n"; $a++; echo $a . "\n"; Output 2e0 3

Is there any way to defend against this one? I know === to turn off type conversion with the equality operator, but what about here?

If condition check type and not try to increment a string...

if (!is_string($notstr)) ++$notstr;

edit:

I think checking for integer is better, if it's just incrementing integer.

I was going to say type hinting but I just realized php's primitive cannot be type hinted.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#138

Post by BasDirks » Mon, May 04, 2015, 3:13 PM UTC

marcofiset wrote: post #115

lars wrote: post #16

Earlier quoted context omitted.

This, combined with the fact that you can increment strings gives some 'interesting' results: $a = "2d9"; $a++; echo $a . "\n"; $a++; echo $a . "\n"; Output 2e0 3

Who tries to increment strings anyway? What is your point here?

Yeah, who would do that? Nobody. So why the _ is it possible in the first place?

Re: PHP: md5('240610708') == md5('QNKCDZO')

#139

Post by sarciszewski » Mon, May 04, 2015, 3:15 PM UTC

FeepingCreature wrote: post #71

sarciszewski wrote: post #68

Earlier quoted context omitted.

> I used an MD5 hash as session id > Never used PHP for anything important since. The problem here isn't PHP, the problem here is you.

Nah, the problem is PHP. See: http://blog.codinghorror.com/falling-into-the-pit-of-success... > When you write code in [PHP], you're always circling the pit of despair, just one misstep away from plunging to your doom.

No, the problem is using a shitty function like MD5 for any practical purpose.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#140

Post by [deleted] » Mon, May 04, 2015, 3:15 PM UTC

WalterGR wrote: post #36

shubhamjain wrote: post #14

PHP's type coercion is nothing like I have every seen in any other language. Its horrendously messy, ugly and completely inexcusable. Strings type-casted to integers are 0. Seriously? Take a look at this, > $arr = array(0, "was", "invented", "in", "india"); > var_dump( in_array("Hello", $arr ) ); and yeah it is TRUE because "Hello" got coerced to 0. I blogged about a major bug, I faced, in PHP, where column name "10t…

PHP's type coercion is nothing like I have every seen in any other language. Its horrendously messy, ugly and completely inexcusable. Is it objectively worse than type coercion in JavaScript?

[deleted]