Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:60499
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.173 as permitted sender)
MIME-Version: 1.0
Sender: tjerk.meesters@gmail.com
In-Reply-To: <733bc8ea59cf6737563a62886e92fcb6.squirrel@www.l-i-e.com>
References: <CAPmfwEnMypV6DFRnRsnCvj+KQk1JG54TX3r1DNHQO3QQ0f+hjA@mail.gmail.com>
	<CAEZPtU4B0HpVrD4nzN6Cm+ogpza=qeyyfA1qSoRiyFF-dh6iFQ@mail.gmail.com>
	<CAORXhGLkKPY=GpfESDqiCVUhG4vZG7PmqK-v7780fGmvnQyeNw@mail.gmail.com>
	<4F847B8A.9010007@sugarcrm.com>
	<733bc8ea59cf6737563a62886e92fcb6.squirrel@www.l-i-e.com>
Date: Mon, 7 May 2012 11:32:30 +0800
Message-ID: <CAHMUw2Ft49f32di4nyOVWhzi-6Qn7u6yP4La2x_Wn2tZK-CHPA@mail.gmail.com>
To: Richard Lynch <ceo@l-i-e.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] [off] PHP: a fractal of bad design
From: datibbaw@php.net (Tjerk Anne Meesters)

On Sun, May 6, 2012 at 12:17 AM, Richard Lynch <ceo@l-i-e.com> wrote:
>> What exactly valid points? =3D=3D is a converting operator, =3D=3D=3D is=
 a
>> strict
>> operator. OK, in his favorite language it is not. Where exactly the
>> valid point is? Author goes at great lengths to refuse to make even a
>> slight mental effort to understand how it works (really, it's not that
>> hard) and then complains it's "useless". Well, a lot of things would
>> be
>> useless if you don't want to know how to use them.
>
> He has a few valid points in the part I read before I got bored...
>
> $a =3D "123ABF453..."; //a password
> $b =3D "123DFEABC..."; //another one
> if ($a =3D=3D $b){
> =A0//you're in.
> }
>
> Yes, one should have validated the input...
>
> But you don't have to be THAT naive to think that the hashed value of
> an SQL injection attack just isn't going to work, so it's "safe"...
>
> I'll bet I have some of these in my (recent) code, for that matter.
>
> On the other hand, if you accept type juggling, you have to expect the
> other cases he has for =3D=3D being a bit strange.

Validated or not, why would type juggling even come into the picture
if both variables are of the same type?

123 =3D=3D "123abc" // sure, why not
"61529519452809720693702583126814" =3D=3D
"61529519452809720000000000000000" // WAT?!

In the above, only the first ~50% of an md5 hash has to be correct.
This gets even worse for SHA256 hashes.