Hacker News Reader

Comment by tyingq | Hacker News Reader

My personal favorite PHP wtf is this one:

  if (md5('240610708') == md5('QNKCDZO')) {
    echo "true\n";
  }

Though I do use php, and love many things about it.

View on HN

Do you know why that is?

  php > echo md5('240610708');
  0e462097431906509019562988736854

  php > echo md5('QNKCDZO');
  0e830400451993494058024219903391

Here is the explanation: https://www.php.net/manual/en/function.md5.php#123392

Would this be avoided by using a string comparison function?

https://www.php.net/manual/en/function.strcmp.php

Yes.

  php > echo strcmp(md5('240610708'), md5('QNKCDZO'));
  -4

Yes, or you can use ===, which will check the type as well. I am trying to get in the habit of using === everywhere now.

Having been out of PHP for several years now, I assume that needs a === instead of ==? It's unfortunate that we have the need for a ===, but it's no different that JS in that regard.

The underlying issue is that while md5() thinks it is returning a hex number, if the hex number starts with 0e, php thinks it's 0^<whatever>.

Reply on news.ycombinator.com