Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHP: md5('240610708') == md5('QNKCDZO')

3v4l.org

Post reply on HN
Print view View original

81–90 of 185 posts

Re: PHP: md5('240610708') == md5('QNKCDZO')

#81

Post by mrtbld »

Rygu wrote: post #21
shubhamjain wrote: post #14

PHP's type coercion is nothing like I have every seen in any other language. Its horrendously messy, ugly and completely inexcusable. Strings type-casted to integers are 0. Seriously? Take a look at this, > $arr = array(0, "was", "invented", "in", "india"); > var_dump( in_array("Hello", $arr ) ); and yeah it is TRUE because "Hello" got coerced to 0. I blogged about a major bug, I faced, in PHP, where column name "10t…

> in_array(.., .., $strict) I think you're aware of the third parameter but for anyone who reads this post, it disables the type coercion of the in_array call.

But beware, with strict comparison: 1 ≠ 1.0 (because int ≠ float).

Re: PHP: md5('240610708') == md5('QNKCDZO')

#82

Post by maw »

dietrichepp wrote: post #6

I'm not exactly clear on how PHP == works, but you can see the MD5 for yourself: $ echo -n 240610708 | md5sum 0e462097431906509019562988736854 - $ echo -n QNKCDZO | md5sum 0e830400451993494058024219903391 - $ echo -n aabg7XSs | md5sum 0e087386482136013740957780965295 - All of them start with 0e, which makes me think that they're being parsed as floats and getting converted to 0.0. This is why "magic" operators like =…

I don't think I'd use the word "magic" here, because it implies that == works when, by any reasonable standard, it does not.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#83

Post by [deleted] »

rimantas wrote: post #67
DoubleMalt wrote: post #54

Earlier quoted context omitted.

Once I wrote a little PHP application to manage a clan in a browser game. I used an MD5 hash as session id that I checked with if(session_id) When users started reporting that their logins would sometimes not work at the first time, I found out that strings that start with zero are coerced to 0 and then interpreted as false. Never used PHP for anything important since.

Yeah, documentation is for pussies.

[deleted]

Re: PHP: md5('240610708') == md5('QNKCDZO')

#84

Post by oisyn »

WalterGR wrote: post #36
shubhamjain wrote: post #14

PHP's type coercion is nothing like I have every seen in any other language. Its horrendously messy, ugly and completely inexcusable. Strings type-casted to integers are 0. Seriously? Take a look at this, > $arr = array(0, "was", "invented", "in", "india"); > var_dump( in_array("Hello", $arr ) ); and yeah it is TRUE because "Hello" got coerced to 0. I blogged about a major bug, I faced, in PHP, where column name "10t…

PHP's type coercion is nothing like I have every seen in any other language. Its horrendously messy, ugly and completely inexcusable. Is it objectively worse than type coercion in JavaScript?

Oh yes. In Javascript, the operands are only coerced if one of the operands is a number. So when comparing two strings (regardless of whether the strings can be interpreted as a number), you always get a regular string compare.

  "12" == "12.0" -> false, basic string compare
Furthermore, if one operand happens to be a number, and the other operand has illegal characters to be interpreted as a number, the two operands aren't equal.

  0 == "foo" -> false, "foo" is not a valid number
  12 == "12 monkeys" -> false, "12 monkeys" is not a valid number
  12 == "12.0" -> true, "12.0" is a valid number, and compares equal to 12.
In short, in Javascript the == operator actually makes sense. In PHP, every single one of above examples would evaluate to true.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#85

Post by return0 »

DoubleMalt wrote: post #54
dietrichepp wrote: post #6

I'm not exactly clear on how PHP == works, but you can see the MD5 for yourself: $ echo -n 240610708 | md5sum 0e462097431906509019562988736854 - $ echo -n QNKCDZO | md5sum 0e830400451993494058024219903391 - $ echo -n aabg7XSs | md5sum 0e087386482136013740957780965295 - All of them start with 0e, which makes me think that they're being parsed as floats and getting converted to 0.0. This is why "magic" operators like =…

Once I wrote a little PHP application to manage a clan in a browser game. I used an MD5 hash as session id that I checked with if(session_id) When users started reporting that their logins would sometimes not work at the first time, I found out that strings that start with zero are coerced to 0 and then interpreted as false. Never used PHP for anything important since.

What did you use for the important stuff that was 100% predictable?

Re: PHP: md5('240610708') == md5('QNKCDZO')

#86

Post by imakesnowflakes »

sarciszewski wrote: post #68
DoubleMalt wrote: post #54

Earlier quoted context omitted.

Once I wrote a little PHP application to manage a clan in a browser game. I used an MD5 hash as session id that I checked with if(session_id) When users started reporting that their logins would sometimes not work at the first time, I found out that strings that start with zero are coerced to 0 and then interpreted as false. Never used PHP for anything important since.

> I used an MD5 hash as session id > Never used PHP for anything important since. The problem here isn't PHP, the problem here is you.

You bought a new car. You took it out for a ride. a tree falls before you. You brake, but the car proceeded to hit the tree anyway.

You call the car company and talk to their engineers. One of them ask. 'Did this happen on a Friday evening, when it was raining?' You say 'Yes, how do you know?'

The engineer replies.

"Our brakes does not work on rainy Friday evenings. If you REALLY want to brake on a rainy Friday evening, you should also pull the lever under the dash board that is normally used to open the hood. It is very clearly printed on our manual. Didn't you read it? Our car is not the problem. You are the problem"

You were enlightened. You came back home. You never took the car out on rainy Friday evenings. When Somebody asks about the car, You said. "Yea, it is a great car. But you got to know how to use it".

You took great pride in knowing how to drive this car, which can easily kill someone who hasn't read the manual. When you hear that someone got killed while driving this car, you simply said. 'That car is Ok. but you should really know how to drive it, sadly this guy didn't. He was the problem, the car ain't...

Re: PHP: md5('240610708') == md5('QNKCDZO')

#87

Post by tellor »

steego wrote: post #77
tellor wrote: post #69

This is well-known PHP-trick. Use === to right result. php > var_dump(md5('240610708') == md5('QNKCDZO')); bool(true) php > var_dump(md5('240610708'), md5('QNKCDZO')); string(32) "0e462097431906509019562988736854" string(32) "0e830400451993494058024219903391" php > var_dump(md5('240610708') === md5('QNKCDZO')); bool(false) php > var_dump("0e462097431906509019562988736854" == "0e830400451993494058024219903391"); bool(…

> This is well-known PHP-trick. Use === to right result. Everybody knows PHP is a trickly-typed language. Read the docs people or PHP will take advantage of your gullible ass.

perhaps ==== operator must reserved

Re: PHP: md5('240610708') == md5('QNKCDZO')

#88

Post by picks_at_nits »

imakesnowflakes wrote: post #86
sarciszewski wrote: post #68

Earlier quoted context omitted.

> I used an MD5 hash as session id > Never used PHP for anything important since. The problem here isn't PHP, the problem here is you.

You bought a new car. You took it out for a ride. a tree falls before you. You brake, but the car proceeded to hit the tree anyway. You call the car company and talk to their engineers. One of them ask. 'Did this happen on a Friday evening, when it was raining?' You say 'Yes, how do you know?' The engineer replies. "Our brakes does not work on rainy Friday evenings. If you REALLY want to brake on a rainy Friday eveni…

From now on, when I write “RTFM,” I will also link to this comment.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#89

Post by josteink »

tellor wrote: post #87
steego wrote: post #77

Earlier quoted context omitted.

> This is well-known PHP-trick. Use === to right result. Everybody knows PHP is a trickly-typed language. Read the docs people or PHP will take advantage of your gullible ass.

perhaps ==== operator must reserved

php_real_equivalence_4()

Re: PHP: md5('240610708') == md5('QNKCDZO')

#90

Post by lsaferite »

mrtbld wrote: post #81
Rygu wrote: post #21

Earlier quoted context omitted.

> in_array(.., .., $strict) I think you're aware of the third parameter but for anyone who reads this post, it disables the type coercion of the in_array call.

But beware, with strict comparison: 1 ≠ 1.0 (because int ≠ float).

But... wouldn't you expect that?

I mean, they AREN'T the same value really.

Post reply on HN