PHP: md5('240610708') == md5('QNKCDZO')

#1

Post by dbrgn » Mon, May 04, 2015, 7:15 AM UTC

PHP: md5('240610708') == md5('QNKCDZO')
3v4l.org

Re: PHP: md5('240610708') == md5('QNKCDZO')

#2

Post by dbrgn » Mon, May 04, 2015, 7:17 AM UTC

Just to make it clear, I did not come up with this example. Unfortunately I can't find out the source anymore. It also contained some technical explanations about why this works. So if anyone remembers, I'd be happy if you could comment with the link.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#3

Post by dbrgn » Mon, May 04, 2015, 7:18 AM UTC

dbrgn wrote: post #2

Just to make it clear, I did not come up with this example. Unfortunately I can't find out the source anymore. It also contained some technical explanations about why this works. So if anyone remembers, I'd be happy if you could comment with the link.

Ah, here it is: https://twitter.com/spazef0rze/status/523010190900469760

Re: PHP: md5('240610708') == md5('QNKCDZO')

#4

Post by [deleted] » Mon, May 04, 2015, 7:46 AM UTC

[deleted]

Re: PHP: md5('240610708') == md5('QNKCDZO')

#5

Post by Meekro » Mon, May 04, 2015, 7:47 AM UTC

PHP's == has a lot of oddball effects. They were put in so that things would behave the way a novice expects them to (3 == '3') but would confuse more experienced programmers, or those coming from other languages.

Unless you're deliberately taking advantage of automatic type conversion and whatnot, you should probably use === by default.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#6

Post by dietrichepp » Mon, May 04, 2015, 7:47 AM UTC

I'm not exactly clear on how PHP == works, but you can see the MD5 for yourself:

    $ echo -n 240610708 | md5sum
    0e462097431906509019562988736854  -
    $ echo -n QNKCDZO | md5sum
    0e830400451993494058024219903391  -
    $ echo -n aabg7XSs | md5sum
    0e087386482136013740957780965295  -

All of them start with 0e, which makes me think that they're being parsed as floats and getting converted to 0.0. This is why "magic" operators like == in PHP and JavaScript never should have existed in the first place. Operators like == should be, by default, extremely boring. PHP's just happens to be a bit more magical even than JavaScript's.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#7

Post by est » Mon, May 04, 2015, 7:49 AM UTC

OK, how did this happen?

Re: PHP: md5('240610708') == md5('QNKCDZO')

#8

Post by EugeneOZ » Mon, May 04, 2015, 7:50 AM UTC

Meekro wrote: post #5

PHP's == has a lot of oddball effects. They were put in so that things would behave the way a novice expects them to (3 == '3') but would confuse more experienced programmers, or those coming from other languages. Unless you're deliberately taking advantage of automatic type conversion and whatnot, you should probably use === by default.

Designers of future languages, please take this example as a proof of the rule: don't design anything for newbies. They will find a way to make an error anyway, but dumbs-based design will be the problem for everyone else.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#9

Post by ck2 » Mon, May 04, 2015, 8:07 AM UTC

I looked at this and said "oh well, at least hhvm is consistent".

Re: PHP: md5('240610708') == md5('QNKCDZO')

#10

Post by masklinn » Mon, May 04, 2015, 8:11 AM UTC

est wrote: post #7

OK, how did this happen?

PHP's `==` tries very hard (even harder than javascript's) to "please" the user. That means if if can it will fallback to converting both sides to numbers and compare that.

Here all hashes are of the form "0e{digits}" which is a valid scientific notation, so when `==` internally converts them to numbers they're all parsed to `float(0)` and therefore equal, success!