PHP expresses two different strings to be the same [duplicate]

ctf遇到一题，绕过 == 操作符判断的 php:md5 相等验证

原理在 stackoverflow上找到了答案

stackoverflow

 php-expresses-two-different-strings-to-be-the-same 

 why-md5240610708-is-equal-to-md5qnkcdzo

Why does the following statement return true?

"608E-4234" == "272E-3063"

"608E-4234" is the float number format, so they will cast into number when they compares.

608E-4234 and 272E-3063 will both be float(0) because they are too small.

For == in php,

If you compare a number with a string or the comparison involves numerical strings, then each string is converted to a number and the comparison performed numerically.

http://php.net/manual/en/language.operators.comparison.php

and

var_dump(md5('240610708') == md5('QNKCDZO'));

Output:

bool(true)

md5('240610708') 's result is 0e462097431906509019562988736854. md5('QNKCDZO') 's result is 0e830400451993494058024219903391. They are both float number format strings (numerical strings), and if you use == in php, when compare a number with a string or the comparison involves numerical strings, then each string is converted to a number and the comparison performed numerically. Both of the strings are converted to 0 when compared with ==, if you want to compare them as string, remember to use ===(strict comparison) instead.

类似

PHP 探测任意网站密码明文/加密手段办法： md5('240610708') == md5('QNKCDZO')

var_dump(md5('240610708') == md5('QNKCDZO'));
var_dump(md5('aabg7XSs') == md5('aabC9RqS'));
var_dump(sha1('aaroZmOk') == sha1('aaK1STfY'));
var_dump(sha1('aaO8zKZF') == sha1('aa3OFF9m'));
var_dump('0010e2' == '1e3');
var_dump('0x1234Ab' == '1193131');
var_dump('0xABCdef' == ' 0xABCdef');

https://news.ycombinator.com/item?id=9484757