How to filter and recognise hash strings in PHP?

Question

At the beginning of every php script, I loop through the possible POST and GET inputs, filter them properly, so later when I need an input, I can use my custom, safe, filtered variable, (which is an array, that holds POSTS and GETS) and I do not have to touch $_GET and $_POST.

If the variable is a hash-value, either a 40 character SHA1, or a 64 character Adobe Stratus ID, how do I recognise them?

I do not want the user, to post some nonsense data.

You want to make sure a variable contains either a 40 or 60 characters long alphanumeric string? — Till Helge, May 07 '13 at 10:50
What characters are allowed in an Adobe Stratus ID? By the way, Stratus is now called Cirrus. — PurkkaKoodari, May 07 '13 at 10:51
For SHA1, you should check this question: http://stackoverflow.com/questions/2982059/testing-if-string-is-sha1-in-php — Juan Pablo Rinaldi, May 07 '13 at 10:52

score 1 · Accepted Answer · answered May 07 '13 at 11:05

1

To test whether a string is a x length hash value or not:

$x = 40
$string = "inputstring";
$boolResult = (preg_match('/^[0-9a-f]{'$x'}$/i', $string) == true) ? true : false;

answered May 07 '13 at 11:05

Gábor DANI

2,063
2
22
40

score 0 · Answer 2 · answered May 07 '13 at 10:52

0

I do not agree that you should avoid _POST and _GET access, but instead you should clean them where possible to avoid XSS. (https://en.wikipedia.org/wiki/Cross-site_scripting). CodeIgniter has a great security library you can pinch and plug into your own stuff.

Other than that, I'm not sure... but I think you are asking to decrypt hashed values from the session?

answered May 07 '13 at 10:52

lukeocodes

1,192
1
16
31

Not possible to decrypt. All I want is a Boolean that tels me if a string is a hash or not. – Ágota Horváth May 07 '13 at 11:00
I think this has been answered here: http://stackoverflow.com/questions/2089428/possible-to-identify-hash-type – lukeocodes May 07 '13 at 11:04

score 0 · Answer 3 · answered May 07 '13 at 10:58

When most of the hash sha , md5 etc returns hex format .. you can easily detect them using ctype_xdigit

if (ctype_xdigit($value)) {
    // It must be Hex
}

I don't know what Adobe Stratus ID looks like but you can easily validated that with preg_match too.

Some can also come in base64 you can also validated that with

if ( base64_encode(base64_decode($data)) === $data){
   // it must be base 64
}

score 0 · Answer 4 · answered May 07 '13 at 11:11

0

you can match a SHA1 hash with a regex like :

/[0-9a-f]{40}/

in PHP :

foreach($_GET as $get) {
    if (preg_match('/[0-9a-f]{40}/i', $get)) {
        // do something
    }
}

answered May 07 '13 at 11:11

max collomb

872
7
3

How to filter and recognise hash strings in PHP?

4 Answers4