PHP: md5('240610708') == md5('QNKCDZO')

Re:PHP: md5('240610708') == md5('QNKCDZO') by lars on Monday May 04, 2015 @04:31AM (#9484981)

This, combined with the fact that you can increment strings gives some 'interesting' results:

    $a = "2d9"; 
    $a++; 
    echo $a . "\n"; 
    $a++; 
    echo $a . "\n";

Output

    2e0
    3

[ Parent | on HN ]

Re:PHP: md5('240610708') == md5('QNKCDZO') by ulrikrasmussen on Monday May 04, 2015 @05:30AM (#9485132)

This is wonderful, I love it!

Interestingly [1], this echoes "2e0" followed by "3" in hhvm-3.7.0, but "3" followed by "4" in hhvm-3.6.0.

[1] http://3v4l.org/sJhP8

[ Parent | on HN ]

Re:PHP: md5('240610708') == md5('QNKCDZO') by debacle on Monday May 04, 2015 @11:16AM (#9486654)

That means that someone was using this "feature" in a relatively core piece of code from the PHP ecosystem. Enough that hhvm felt they needed to support it.

[ Parent | on HN ]

Re:PHP: md5('240610708') == md5('QNKCDZO') by jlouis on Monday May 04, 2015 @09:14AM (#9485904)

There is some nasty type conversion going on here, from the type of stochastic random throws of two nine-sided dice to floats to integers. Where is your type preservation, PHP?

[ Parent | on HN ]

Re:PHP: md5('240610708') == md5('QNKCDZO') by Someone1234 on Monday May 04, 2015 @10:03AM (#9486170)

Is there any way to defend against this one? I know === to turn off type conversion with the equality operator, but what about here?

[ Parent | on HN ]

Re:PHP: md5('240610708') == md5('QNKCDZO') by digitalzombie on Monday May 04, 2015 @11:04AM (#9486566)

If condition check type and not try to increment a string...

if (!is_string($notstr)) ++$notstr;

edit:

I think checking for integer is better, if it's just incrementing integer.

I was going to say type hinting but I just realized php's primitive cannot be type hinted.

[ Parent | on HN ]

Re:PHP: md5('240610708') == md5('QNKCDZO') by marcofiset on Monday May 04, 2015 @09:58AM (#9486137)

Who tries to increment strings anyway? What is your point here?

[ Parent | on HN ]

Re:PHP: md5('240610708') == md5('QNKCDZO') by mikeash on Monday May 04, 2015 @10:37AM (#9486367)

Given how happy PHP is about converting strings to integers on demand, it would be pretty easy to take string input intended to be a number, forget to actually convert it, and go around using it happily until one day you accidentally set off a bomb.

[ Parent | on HN ]

Re:PHP: md5('240610708') == md5('QNKCDZO') by BasDirks on Monday May 04, 2015 @11:13AM (#9486627)

Yeah, who would do that? Nobody. So why the _ is it possible in the first place?

[ Parent | on HN ]

Re:PHP: md5('240610708') == md5('QNKCDZO') by pionar on Monday May 04, 2015 @10:03AM (#9486171)

because PHP is dynamically typed, it's easier to accidentally increment a string.

[ Parent | on HN ]