Common PHP Weak‑Type Vulnerabilities: MD5 Collision, is_numeric, in_array, switch, and intval Issues

Because PHP is a weakly typed language, many built‑in functions exhibit conversion and comparison quirks that can become security vulnerabilities.

1. MD5 Encryption Vulnerability

When comparing hash strings, PHP interprets any value beginning with "0x" as scientific notation, which evaluates to zero; consequently, two different passwords whose MD5 hashes start with "0e" are considered equal. This also illustrates the concept of hash collisions.

md5($str1),
    'md5_str2' => md5($str2),
    'bool' => md5($str1) == md5($str2)
]);
?>

The output shows both hashes beginning with 0e and the comparison evaluating to true , meaning an attacker could exploit a password that hashes to a 0e prefix.

2. is_numeric Vulnerability

PHP’s is_numeric function ignores hexadecimal notation (e.g., 0x ), which can be abused to hide malicious input and facilitate SQL injection.

echo json_encode([
    is_numeric(233333),
    is_numeric('233333'),
    is_numeric(0x233333),
    is_numeric('0x233333'),
    is_numeric('233333abc'),
]);

The result is [true, true, true, false, false] . For example, the hexadecimal 0x61646D696E corresponds to the string "admin", and a query like SELECT * FROM tp_user WHERE username=0x61646D696E would retrieve the admin record.

3. in_array Vulnerability

in_array first casts values to integers; non‑numeric strings are truncated or become zero, leading to unexpected matches.

The dump returns bool(true) , demonstrating the flaw.

4. switch Vulnerability

Similar to in_array , switch casts the switch expression to integer before comparison, so a string like "abc" is treated as 0 .

The output is "i是比3小的数".

5. intval Casting Vulnerability

The intval function casts strings to integers, stopping at the first non‑numeric character; this can produce misleading results.

These examples illustrate how implicit casting can affect program logic.

—

If you found this article helpful, please like and share to support the author.