Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHP: md5('240610708') == md5('QNKCDZO')

3v4l.org

Post reply on HN
Print view View original

151–160 of 185 posts

Re: PHP: md5('240610708') == md5('QNKCDZO')

#151

Post by Killswitch »

eropple wrote: post #133
Killswitch wrote: post #108

Earlier quoted context omitted.

shhhhh, people don't realize PHP started out as just a tool for Rasmus and ended up evolving. No, to them, PHP was DESIGNED this way on purpose from the ground up.

Do you consider that an acceptable excuse for its behaviors fifteen years after the fact? Because I do not.

Of course not, but everyone keeps comparing PHP to languages that were designed and developed to be languages, not a toolset that some crappy developer (his own words) created for his personal site that ended up evolving and becoming a real language.

It's got quirks, we get it. Let's keep improving the language as we go instead of constantly bashing it. I mean PHP is one of the most widely used languages on the web today.. Clearly it's doing something right.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#152

Post by tormeh »

Schlaefer wrote: post #131
tormeh wrote: post #113

Earlier quoted context omitted.

That's actually interesting. It's not obvious to me that "2" should be parsed as an int and not a string. Perhaps we should either be explicit about what we want "2" to be parsed as (int, long, float, double, bigint, bigfloat, string...) or let the parsing of a number be determined in a more dynamic way. If you're comparing a string with an integer literal, then you probably want the string interpretation of the lite…

We are pretty sure what the literals mean. On the other hand we have many string channels: get/post/cookie/persistent storage¹/… Given that environment its probably natural that you try to convert a string into its "intended" type. ¹no DB, but the "just write your visitor counter into a plain text file" back then

>We are pretty sure what the literals mean.

News to me. You have to enter a really high-precision number as a string in Java so it won't be rounded off to fit within a double. This is an unsolved problem.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#153

Post by Silhouette »

bcruddy wrote: post #130
ams6110 wrote: post #98

Earlier quoted context omitted.

To be fair, this kind of thing (maybe not exactly this, but type-coercion bugs) can happen in JavaScript, which is all the rage now for "important" stuff.

Yeah but javascript has 'use strict' whereas PHP decided that the easter egg "looks like you're using the wrong language!" was more important than actually allowing a 'use strict' to force === instead of ==.

While that's true, JavaScript is still horribly error-prone because of this. The suggestion that JS would be a much better language if the == operator worked more like === in the first place is very reasonable.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#154

Post by sukilot »

adamzochowski wrote: post #143
Nemcue wrote: post #136

Earlier quoted context omitted.

"This sort of thing happens in type conversion languages. You can either use === to stop conversion or you can understand how conversion works." Even JavaScript isn't insane enough to somehow coerce a string to 0.

Yes, JavaScript will convert strings into numbers console.log(5*"12"); 60 console.log(5*"0x0C"); 60

12 is not 0.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#155

Post by Silhouette »

Navarr wrote: post #122
FeepingCreature wrote: post #71

Earlier quoted context omitted.

Nah, the problem is PHP. See: http://blog.codinghorror.com/falling-into-the-pit-of-success... > When you write code in [PHP], you're always circling the pit of despair, just one misstep away from plunging to your doom.

I'd be willing to say this is true for any language in varying ways.

But to widely varying degrees. This kind of problem is a direct consequence of having a relatively weak and dynamic type system (or other semantics that mean you might as well have).

Plenty of people have warned about this kind of danger for a very long time. However, there seems to be a significant subset of the web development community that only has experience with languages like JS and PHP and to a lesser extent other dynamic languages like Ruby and Python, who simply fail to realise how many of these bugs should have been entirely prevented by using better tools by now. The usual counter seems to be something about unit tests, at which point anyone following the discussion who actually knows anything about type systems and the wider world of programming languages dies a little inside.

It is entirely fair to criticise bad tools for being bad, particularly in specific ways and with clearly identified problems that can result as in this case. It's bad enough that we are stuck with JS for front-end web development these days, but there aren't many good arguments for using something as bad as PHP on the back-end in 2015.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#156

Post by eropple »

Killswitch wrote: post #151
eropple wrote: post #133

Earlier quoted context omitted.

Do you consider that an acceptable excuse for its behaviors fifteen years after the fact? Because I do not.

Of course not, but everyone keeps comparing PHP to languages that were designed and developed to be languages, not a toolset that some crappy developer (his own words) created for his personal site that ended up evolving and becoming a real language. It's got quirks, we get it. Let's keep improving the language as we go instead of constantly bashing it. I mean PHP is one of the most widely used languages on the web t…

People compare PHP to other languages regularly used in 2015 for web development. In that light, it compares very poorly.

McDonald's is super popular, too, and deserves even more of a ration of shit than they get for feeding people slop.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#157

Post by Silhouette »

kyllo wrote: post #96
dietrichepp wrote: post #6

I'm not exactly clear on how PHP == works, but you can see the MD5 for yourself: $ echo -n 240610708 | md5sum 0e462097431906509019562988736854 - $ echo -n QNKCDZO | md5sum 0e830400451993494058024219903391 - $ echo -n aabg7XSs | md5sum 0e087386482136013740957780965295 - All of them start with 0e, which makes me think that they're being parsed as floats and getting converted to 0.0. This is why "magic" operators like =…

Ahh PHP, the language where true == false php > if ((true == "foo") && ("foo" == 0) && (0 == false)) echo "yay!"; yay!

I've never seen one, but somewhere there must surely be a PHP version of the infamous 'WAT' talk about JavaScript, full of examples like this and the "2d9"->"2e0"->3 example mentioned by lars.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#158

Post by Silhouette »

Navarr wrote: post #123
jakcst wrote: post #116

Earlier quoted context omitted.

This truly just bummed me out :(

Don't let it - he understands exactly how the types are being converted in order to make it appear that true == false. This sort of thing happens in type conversion languages. You can either use === to stop conversion or you can understand how conversion works. I'm not sure how the order of conversions is decided by PHP, but here's a brief explanation: Compare "foo" to true. Convert the string "foo" to a boolean valu…

You can either use === to stop conversion or you can understand how conversion works.

It has been my experience that, to a first approximation, no-one fully understands how conversion works in such languages to the point of never getting it wrong in practice.

Of course we didn't know that would be the case when some of these languages were first created, but I think it is a compelling argument for making an actual-equality == operator the default in any new programming language design. There are enough plausible differences because of things like reference vs. value semantics already, without breaking basic intuitions about what comparisons mean as well.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#159

Post by redthrowaway »

dietrichepp wrote: post #6

I'm not exactly clear on how PHP == works, but you can see the MD5 for yourself: $ echo -n 240610708 | md5sum 0e462097431906509019562988736854 - $ echo -n QNKCDZO | md5sum 0e830400451993494058024219903391 - $ echo -n aabg7XSs | md5sum 0e087386482136013740957780965295 - All of them start with 0e, which makes me think that they're being parsed as floats and getting converted to 0.0. This is why "magic" operators like =…

Type coercion is fine so long as you recognize it as the syntactic sugar that it is. JS and PHP support easy type coercion because HTTP is string-only and it would be a pain in the ass to explicitly cast every value you get over the wire. You just have to be sure that, when you use it, you do so intentionally and not out of laziness.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#160

Post by Navarr »

sukilot wrote: post #154
adamzochowski wrote: post #143

Earlier quoted context omitted.

Yes, JavaScript will convert strings into numbers console.log(5*"12"); 60 console.log(5*"0x0C"); 60

12 is not 0.

Yes and no. JavaScript gives you the good ol' "NaN" which is a number (despite not being a number).

PHP doesn't have that concept in it.

Post reply on HN