= And "implicit conversion" in PHP"

Introduction to implicit conversions in PHP

Recently, there was a post on Hacker News (https://news.ycombinator.com/item? Id = 9484757), mentioned a method to detect website password encryption.

   
The result is:
  
bool(true)bool(true)bool(true)
  
If you use 240610708 as the password and then use QNKCDZO to log on to a website, the password is saved in MD5 mode. Similarly, if aaroZmOk is used as the password and then aaK1STfY is used for logon, the password is saved as sha1. The third type is plaintext storage.
Analysis
Take the first group as an example:
  
The result of md5 ('200') is: 0e462097431906509019562988742554md5 ('qnkcdzo '): 0e830400451993494058024219903391
  
Because PHP is a weak language, if you use the = sign to compare a number with a string or a string that involves the number content, the string is converted to a value and compared to a value. This rule also applies to switch statements. In the preceding example, the two strings start with 0e scientific notation. the strings are implicitly converted to floating point numbers, which are actually equivalent to 0x10 ^ 0. Therefore, they are equal.
Similar
    
The first returns true, and the second returns false.
Conclusion
"=" Should be used for Hash verification in PHP, instead of "= ". In addition, if the production environment version is high enough (PHP> = 5.6.0), it is best to use the hash_equals () function.
  
Hash_equals () compares two strings. whether they are equal or not, the time consumption of the function is constant and can be used to prevent time series attacks.