Different hashes for (apparently) identical strings

Question

I'm getting different hash values for database-retrieved string and same value submitted through html form.

What am I doing wrong?

database:

SET NAMES utf8;
SET foreign_key_checks = 0;
SET time_zone = '+05:30';
SET sql_mode = 'NO_AUTO_VALUE_ON_ZERO';

DROP TABLE IF EXISTS `fcb_task`;
CREATE TABLE `fcb_task` (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `state` enum('unlocked','locked') CHARACTER SET latin1 NOT NULL,
  `task_specific_notes` text CHARACTER SET latin1,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=ascii;

INSERT INTO `fcb_task` (`id`, `state`, `task_specific_notes`) VALUES
(529,   'unlocked', 'INCLUDED USERS:ONE USER PER LINE:\n1001921: Sudhamayi  Gill\n1001931: Ananga  Gupta\n----------------------------------------------------------------\nDESCRIPTION:\n elit ac molestie praesent convallis etiam metus in, augue sapien praesent pulvinar imperdiet class. sed fringilla eget pellentesque ullamcorper tincidunt congue dolor aliquet nulla, rutrum varius tortor dapibus mi gravida a sociosqu, cras ut sed curabitur sodales nibh feugiat sit. ipsum felis nam neque ultricies nibh libero luctus magna, mi arcu hendrerit purus consectetur duis etiam. molestie feugiat hac per semper sapien nisi etiam mollis, est sagittis auctor aliquet curae per pellentesque. luctus dolor magna eros dapibus facilisis massa cras molestie pulvinar, consequat suscipit rhoncus quisque lorem nulla diam odio ac nulla, tristique fermentum ut tempor faucibus fringilla eleifend scelerisque. \r\n erat sodales litora laoreet cursus mattis turpis duis metus ut iaculis, ipsum habitant fusce dui morbi in elit dictumst nisi tellus iaculis, praesent auctor senectus habitant pulvinar augue etiam augue ut. ad accumsan nunc etiam platea tempor at, enim aenean ultrices eleifend litora ad donec, gravida eleifend quis fames non. ut massa feugiat elementum ipsum rhoncus eleifend elit nibh etiam, semper dictumst adipiscing pulvinar nunc torquent eleifend donec. porttitor in et mauris dui ullamcorper at et tellus at, praesent neque turpis nisl arcu elit etiam ut consectetur, platea mauris gravida ante posuere sed accumsan mauris.\r\n\r\nnostra dapibus leo facilisis, iaculis. \r\n ut congue taciti suspendisse praesent auctor mauris massa vulputate, euismod nam tempus massa donec ornare dui nisi eleifend, augue suspendisse pharetra lectus conubia potenti lorem. in ad consequat consectetur integer odio hac, ipsum lobortis fames dolor aenean urna dictumst, vitae porta rhoncus netus hendrerit. accumsan vestibulum accumsan potenti convallis ullamcorper diam molestie, aliquam amet placerat neque faucibus magna sociosqu, praesent turpis odio praesent bibendum semper. lacinia mauris tellus dolor turpis cursus cubilia condimentum, aliquet neque lacus habitasse ultricies eget, dictum inceptos tincidunt consectetur nisi egestas. imperdiet nisl congue etiam accumsan felis, aliquet ornare fringilla curae rutrum, pellentesque risus maecenas eget. ');][1]

weirdsha1.php

<?php
$conn = mysqli_connect('localhost','root','toor','problem') or die("Connection Failed");
$result = mysqli_query($conn,"SELECT `task_specific_notes` FROM `fcb_task` LIMIT 1") or die("query failed");
$task_specific_notes = null;
while($row = mysqli_fetch_assoc($result)){
    $task_specific_notes = $row['task_specific_notes'];
}

$post_SHA256 = 'Not calculated';
if($_SERVER['REQUEST_METHOD']=='POST'){
    $post_SHA256 = hash('sha256',$_POST['task_specific_notes']);
}


?>
<!DOCTYPE html>
<html>
<body>
<form method="post">
<textarea readonly="readonly" name="task_specific_notes" rows="15" cols="80"><?php echo $task_specific_notes;?></textarea>
<br>
<input type="submit">
</form>
<p>sha256 of database value: <?php echo hash('sha256',$task_specific_notes); ?></p>
<p>sha256 of string submitted :<?php if(isset($post_SHA256)) echo $post_SHA256; ?></p>
</body>
</html>

I think character encoding is involved, but can't figure the exact problem.

enter image description here

Please post plain text as text, not as screenshots. Retyping that to reproduce the problem is not going to happen. — tadman, Mar 31 '14 at 14:44
There are more than 2000 characters there which have to be **absolutely identical** between the database and `$_POST` data? Collapsed whitespaces will kill the match, as will variations in `newline` characters - are you sure this is what you want to do? It seems ... fragile. — CD001, Mar 31 '14 at 14:54
@tadman plaintext posting is not gonna help as plaintext values become absolutely identical. — Mukesh Soni, Mar 31 '14 at 14:56
@jeroen thanks for suggestion. var_dump displays different lengths for the database value and post value-2320 and 2315 respectively. — Mukesh Soni, Mar 31 '14 at 15:03
@MukeshSoni That's not entirely true. Often you'll have invisible characters in there that make all the difference. If you wanted to be sure it was represented accurately, paste it as a Base64-encoded string. — tadman, Mar 31 '14 at 15:49
@CD001 no, I'm not sure. that's why I put this question on SO — Mukesh Soni, Mar 31 '14 at 16:19

score 1 · Accepted Answer · answered Mar 31 '14 at 14:43

Take a look at the byte stream of the strings via

foo($_POST['task_specific_notes']);
foo($task_specific_notes);

function foo($s) {
    echo '<pre>';
    for($i=0;$i<strlen($s); $i++) {
        printf('%02X ', ord($s[$i]));
    }
    echo '</pre>';
}

The connection to the MySQL server has an encoding "attached" to it as well.
So if for example the input from the browser is utf-8 encoded but the MySQL connection uses latin-1 you can easily get differently encoded strings.

Different hashes for (apparently) identical strings

1 Answers1