vinkla / hashids

A small PHP library to generate YouTube-like ids from numbers. Use it when you don't want to expose your database ids to the user.
https://hashids.org/php
MIT License
5.27k stars 417 forks source link

Collision (different number, same hashid) #145

Closed artyuum closed 4 years ago

artyuum commented 4 years ago

Hi, I'm using Hashids 4 on PHP 7.4.8 and I have the "gmp" extension installed. Here is a snippet allowing you to reproduce the collision:

<?php

require 'vendor/autoload.php';

use Hashids\Hashids;

$encodedIds = [];

$hashids = new Hashids();

foreach (range(0, 100000) as $number) {
    $encodedId = $hashids->encode($number);
    $collisionIndex = array_search($encodedId, $encodedIds);

    if ($collisionIndex) {
        echo "Collision with:\n";
        echo $collisionIndex  . ' -> ' . $encodedId;

        echo "\n\n";

        echo "For:\n";
        echo $number . ' -> ' . $encodedId;

        die("\n");
    }

    $encodedIds[] = $encodedId;
}

echo 'Done';

Output

Collision with:
587 -> 0E97

For:
25543 -> 0E97
vinkla commented 4 years ago

587 → 0E3 25543 → 0E97

In the future, please submit a pull request with a failing test.

artyuum commented 4 years ago

587 → 0E3 25543 → 0E97

I don't understand what you said, what is this? Did you execute the snippet above? This is the result?

vinkla commented 4 years ago

This is the result?

Yes.

artyuum commented 4 years ago

This is weird, array_search() is supposed to find for duplicate encoded IDs and in your reply above 0E3 != 0E97. I'll try to open a PR with a failing test.