'-var_dump(md5(223704217))-' -

Use hash_equals() for comparing hashes, as it is also resistant to timing attacks. If you'd like, I can:

To prevent this vulnerability, always use operators or built-in secure hash comparison functions: Use === instead of == . '-var_dump(md5(223704217))-'

Attackers use these specific strings to . If a system compares a user-provided password hash to a stored hash using == , an attacker can provide an input like 223704217 . As long as the stored password also hashes to a 0e... format, the comparison will return true even if the passwords don't match. Comparison Guide Comparison Type Result for md5(223704217) Description Loose == true (if compared to 0 or 0e... ) Vulnerable. PHP converts the string to a float ( Strict === false Secure. Checks both the value and the data type. How to Fix It Use hash_equals() for comparing hashes, as it is