PHP: md5('240610708') == md5('QNKCDZO')

Post by sarciszewski » Mon, May 04, 2015, 3:15 PM UTC

nathanb wrote: post #105

sarciszewski wrote: post #70

Earlier quoted context omitted.

And in C we can do this to get TRUE: return (33 == '3'); :P

Incorrect. However, (0x33 == '3') will return true, as will (51 == '3'). Your point is valid, even if your code is wrong. Automatic type coercion can produce unexpected results in any language. PHP's automatic type coercion rules are designed to help newbies at the expense of experienced developers. C's automatic type coercion rules are, largely, designed to expose the underlying memory layout to developers who know…

Post by adamzochowski » Mon, May 04, 2015, 3:18 PM UTC

Nemcue wrote: post #136

Navarr wrote: post #123

Earlier quoted context omitted.

Don't let it - he understands exactly how the types are being converted in order to make it appear that true == false. This sort of thing happens in type conversion languages. You can either use === to stop conversion or you can understand how conversion works. I'm not sure how the order of conversions is decided by PHP, but here's a brief explanation: Compare "foo" to true. Convert the string "foo" to a boolean valu…

"This sort of thing happens in type conversion languages. You can either use === to stop conversion or you can understand how conversion works." Even JavaScript isn't insane enough to somehow coerce a string to 0.

    console.log(5*"12");
    60
    console.log(5*"0x0C");
    60

Post by tveita » Mon, May 04, 2015, 3:56 PM UTC

DoubleMalt wrote: post #54

dietrichepp wrote: post #6

I'm not exactly clear on how PHP == works, but you can see the MD5 for yourself: $ echo -n 240610708 | md5sum 0e462097431906509019562988736854 - $ echo -n QNKCDZO | md5sum 0e830400451993494058024219903391 - $ echo -n aabg7XSs | md5sum 0e087386482136013740957780965295 - All of them start with 0e, which makes me think that they're being parsed as floats and getting converted to 0.0. This is why "magic" operators like =…

Once I wrote a little PHP application to manage a clan in a browser game. I used an MD5 hash as session id that I checked with if(session_id) When users started reporting that their logins would sometimes not work at the first time, I found out that strings that start with zero are coerced to 0 and then interpreted as false. Never used PHP for anything important since.