• Demoli (unregistered) in reply to Ken B

    Finally, a perfect way to detect JS.

    And there I was being a pansy by using progressive enhancement :)

  • SR ** (unregistered) in reply to Demoli
    Demoli:
    Finally, a perfect way to detect JS.

    And there I was being a pansy by using progressive enhancement :)

    JS? Progressive enhancement? Pah! Java applets are where it's at!

  • (cs) in reply to Anonymous
    Anonymous:
    XIU:
    Math.Random() * 899 + 100
    We didn't really need a solution to this trivial problem but it's quite funny that you've actually managed to get it wrong. The SWF expects an integer between 100 and 999. Your solution will return a float instead of an int. For example, Javascript's random function could return 0.00001. Your code above would result in 0.00001 * 899 + 100 = 100.00899. That's no good I'm afraid, probably why the original coder used PHP! If you're looking for a hint, check out the Math.floor() function.

    Not a Javascript coder, but the original comment was about needing a few extra lines of code. Even with the extra Math.floor() call the code is still pretty easy.

  • Bim Job (unregistered) in reply to SR **
    SR **:
    Tiago "pacman" Peczenyj:
    function myRandom(){ return 85; }

    FTFY

    2nd attempt, now a spam filter nag?

    No, just a server-side implementation of rand().

    Ya gotta watch for these things. They can get recursive on you.

  • Mike Caron (unregistered) in reply to Dave
    Dave:
    Mike Caron:
    Frast!!!one

    Also, this clearly isn't a WTF. PHP runs on the server, and is guaranteed to run, while Javascript may be disabled in the client. Duh!

    Except the only line of PHP was to generate JavaScript code. Which wouldn't run anyway.

    Whoosh!

    May want to get your humour detector calibrated...

  • (cs) in reply to The version I wanted to see
    The version I wanted to see:
    What about the ayn.rand() function? It would randomly pick from words like "free", "market", "capitalism" and so forth.

    That's not available in Javascript. It is, however, part of the Objectivist-C standard library.

  • Patrick (unregistered) in reply to virgil
    virgil:
    You obviously have no understanding of the small details of web programming. If that page was loaded from the website, the SWF received a different parameter each time - and thus would behave differently each time.
    'Scuse me?
    .htaccess:
    <FilesMatch "\.(html|htm|php)$"> Header set Cache-Control "max-age=604800, private, proxy-revalidate" </FilesMatch>

    Who knows what about what now?

  • Anonymous (unregistered) in reply to XIU
    XIU:
    Anonymous:
    XIU:
    Math.Random() * 899 + 100
    We didn't really need a solution to this trivial problem but it's quite funny that you've actually managed to get it wrong. The SWF expects an integer between 100 and 999. Your solution will return a float instead of an int. For example, Javascript's random function could return 0.00001. Your code above would result in 0.00001 * 899 + 100 = 100.00899. That's no good I'm afraid, probably why the original coder used PHP! If you're looking for a hint, check out the Math.floor() function.

    Not a Javascript coder, but the original comment was about needing a few extra lines of code. Even with the extra Math.floor() call the code is still pretty easy.

    Of course, you're absolutely right. This could easily be done on one line using Javascript's "random" and "floor" but who knows, maybe the original coder couldn't quite figure that out. We've certainly seen that sort of thing before on TDWTF!

  • Bim Job (unregistered) in reply to Mason Wheeler
    Mason Wheeler:
    The version I wanted to see:
    What about the ayn.rand() function? It would randomly pick from words like "free", "market", "capitalism" and so forth.

    That's not available in Javascript. It is, however, part of the Objectivist-C standard library.

    Winner!

    Which I suppose, from an Objectivist point of view, is sort of the point.

    Incidentally, there's a rather nauseating essay prize offered by the Ayn Rand Institute for college students who wish to become a future Chairman of the Federal Reserve. Something about Jesuits and young children springs to mind, here.

  • (cs)

    Actually I the other day I was using javascript's random function and noticed it's really badly implemented, or at least the seed is.

    I was calling it twice in rapid succession, and they (the two calls) always gave the same number, ALWAYS. As if it was based on the current time, but in some kind of weird and wrong way.

    I actually did replace that instance of generating a random number with one PHP function call (quite like the 'WTF') because it yielded better results. I have no idea if the PHP random is any better or if it's implementation is really rubbish, but at least two successive calls don't give the same number (and because it involved displaying images, the javascript one always displayed the same images).

    So not really a WTF in my eyes.

  • jdb (unregistered)

    at least he didn't use short open tags, right?

  • Rabid Troller (unregistered) in reply to Anonymous

    Now now, assuming makes out of you and me.

    stop encouraging people to be smart, or else this site will run out of inspiration for articles... oh wait..

    CAPTCHA: enim Who knew the captcha generator was capable of typos?

  • imu (unregistered)

    It's not failure.

    It's deferred success now.

  • Bim Job (unregistered) in reply to pbean
    pbean:
    Actually I the other day I was using javascript's random function and noticed it's really badly implemented, or at least the seed is.

    I was calling it twice in rapid succession, and they (the two calls) always gave the same number, ALWAYS. As if it was based on the current time, but in some kind of weird and wrong way.

    I actually did replace that instance of generating a random number with one PHP function call (quite like the 'WTF') because it yielded better results. I have no idea if the PHP random is any better or if it's implementation is really rubbish, but at least two successive calls don't give the same number (and because it involved displaying images, the javascript one always displayed the same images).

    So not really a WTF in my eyes.

    Well, there's a difference between random numbers based upon "the first time you see them," seeded random numbers, salted random numbers, and whatever sort of random number you desire. None of them are particularly related to Javascript or PHP or anything. That's kind of the point, if you want to check out the OP.

    It's a WTF. Your eyes need testing.

    Squint a bit at this.

  • jesus_christ_you_people (unregistered)

    64 comments and that Bim Job guy hasn't complained about PHP or the people who use it yet? It's even an article about PHP. What gives, dude?

  • Joe (unregistered) in reply to DOA

    Surely a server-side rand is a different animal from a client-side rand?

  • (cs)

    Because Javascript's Math.random() returns a float between 0 and 1. Obviously the person that did this didn't understand multiplication...

  • anon (unregistered) in reply to Bim Job
    Bim Job:
    Mason Wheeler:
    The version I wanted to see:
    What about the ayn.rand() function? It would randomly pick from words like "free", "market", "capitalism" and so forth.

    That's not available in Javascript. It is, however, part of the Objectivist-C standard library.

    Winner!

    Which I suppose, from an Objectivist point of view, is sort of the point.

    Incidentally, there's a rather nauseating essay prize offered by the Ayn Rand Institute for college students who wish to become a future Chairman of the Federal Reserve. Something about Jesuits and young children springs to mind, here.

    really? you find $5,000 nauseating?

  • (cs) in reply to anon
    anon:
    Bim Job:
    Mason Wheeler:
    The version I wanted to see:
    What about the ayn.rand() function? It would randomly pick from words like "free", "market", "capitalism" and so forth.

    That's not available in Javascript. It is, however, part of the Objectivist-C standard library.

    Winner!

    Which I suppose, from an Objectivist point of view, is sort of the point.

    Incidentally, there's a rather nauseating essay prize offered by the Ayn Rand Institute for college students who wish to become a future Chairman of the Federal Reserve. Something about Jesuits and young children springs to mind, here.

    really? you find $5,000 nauseating?

    Better stated, there's a rather nauseating essay contest run by the Ayn Rand Institute...

    Third attempt

  • Blakeyrat (unregistered) in reply to Captain Obvious
    Captain Obvious:
    This may not be obvious to all, but I'd imagine using PHP instead of JS would have only 1 plausible effect.

    Caching.

    Instead of the flash url being random for every page load, it would only change between non-cached page loads.

    IE: You could adjust the cache time of the video by adjusting the cache time for the page it was referred from.

    Of course, you could just adjust the cache time of the video, but having them bound together plausibly has use.

    But I'd probably want the code to be a bit more intent-oriented to explain that is what they wanted from it.

    Praytell, why would the caching situation be any different if they were using Javascript for this?

    Like, if you add a URL param in the JS, the browser, "hah! a URL param! That JS, always kidding around!" and loads the cached copy anyway?

  • (cs) in reply to Anonymous
    Anonymous:
    XIU:
    Anonymous:
    XIU:
    Math.Random() * 899 + 100
    We didn't really need a solution to this trivial problem but it's quite funny that you've actually managed to get it wrong. The SWF expects an integer between 100 and 999. Your solution will return a float instead of an int. For example, Javascript's random function could return 0.00001. Your code above would result in 0.00001 * 899 + 100 = 100.00899. That's no good I'm afraid, probably why the original coder used PHP! If you're looking for a hint, check out the Math.floor() function.

    Not a Javascript coder, but the original comment was about needing a few extra lines of code. Even with the extra Math.floor() call the code is still pretty easy.

    Of course, you're absolutely right. This could easily be done on one line using Javascript's "random" and "floor" but who knows, maybe the original coder couldn't quite figure that out. We've certainly seen that sort of thing before on TDWTF!

    If the value was intended for consumption by the SWF, it'd be in a FlashVar, not in a URL param. Unless the SWF IS looking at the URL param, in which case that's The Real WTF.

    To me it's obviously a poorly-implemented cache-buster.

  • (cs) in reply to elektronaut

    [quote user='elektronaut']Not to mention the fact that Flash has Math.random built in.[/quote] To you and others who said the same:

    This is true, the current, and many recent, versions of flash have Math.random. However, I recall a time when there was no Math library (no library structure at all, it was entirely functional). I recall a before time when Flash had no random function anywhere.

    Since the codebase referenced is old, likely the Flash is similarly old. And, unlike PHP/JavaScript, Flash is possibly unfixable since the source != the execution code.

  • Slicerwizard (unregistered) in reply to DOA
    DOA:
    This must be similar to TDWTF's typo.rand() function.
    No, the typos are still there even when I disable JavaScript.

    "Michael was tasked with updating some of code"

    Yeah, it's still there. Damn - you had my hopes up for a minute...

  • Cornelius amabat Eucleides, mmMMMmm (unregistered) in reply to Bim Job
    Bim Job:
    Contraxit hanc dum assidet Iuniae.

    I just like the way Google translate says:

    Google:
    We are not yet able to translate from Latin into English.

    ...there's something comforting in the fact that my appalling school boy efforts at Latin translation cannot be surpassed by a few million dollars of hardware and software.

    If only I could have had that excuse for Mr Parr 20+ years ago.

  • sim (unregistered) in reply to DOA

    this piece of code is to prevent ie from caching the flash movie and not initializing the flash behaviour

  • Laughing Jack (unregistered) in reply to SR **
    SR **:
    Patrick:
    Sometimes it's frustrating to say to someone "take a look at this funny video!" only to find that it's been replaced by someone throwing a puppy off a balcony.
    Ah puppyrolling. It's my favourite thing after cheese.
    You're officially the hero of the hour.
  • (cs)

    Well, you just can't trust the user's browser to be random these days. You could before, when all the browsers implemented their own random html, but now all browsers gots to be standardised, son. They ain't random no more.

  • (cs) in reply to anon
    anon:
    Bim Job:
    Incidentally, there's a rather nauseating essay prize offered by the Ayn Rand Institute for college students who wish to become a future Chairman of the Federal Reserve. Something about Jesuits and young children springs to mind, here.
    really? you find $5,000 nauseating?
    You're parsing his comment incorrectly. It's a (rather nauseating essay) prize, not a rather nauseating (essay prize).
  • Yaba (unregistered)

    Well, there is a significant difference: The user can disable JavaScript for security reasons - therefore it's safer to calculate the random number on the server side with PHP.

  • nah (unregistered) in reply to You didn't see me right
    You didn't see me right:
    in b4 "all PHP devs are retards" or "this is why I wouldn't use PHP to put out my own mother if she was on fire"
    I wouldn't use PHP to put out my mother if she was on fire, I'd use a bucket of water or a non-syntetic blanket.
  • Da' man (unregistered) in reply to Anonymous
    Anonymous:
    Well it's pretty stupid but it's hardly outrageous. I would imagine the reason behind this is because PHP's rand() function takes two parameters to specify min and max bounds...
    Or - quite possibly - he couldn't find Math.Random in his copy of "JavaScript Bible" (hint: use Google instead!)
  • Da man (unregistered) in reply to Yaba
    Yaba:
    Well, there is a significant difference: The user can disable JavaScript for security reasons - therefore it's safer to calculate the random number on the server side with PHP.
    Oh, that's good. You turned a mildly stupid code deviation into a major WTF! Congratulations!
  • Nonsense (unregistered)

    Adding the flash object in html makes IE asking the user to 'click to activate the control'. Added via JS this question does not occur. (Case of security by obscurity I guess).

    Captcha: haero: Kind of hairy hero? - Try to enter Yeti?

  • undefined (unregistered) in reply to Nonsense

    Now, it's because of patent. Opera do it in similar way.

  • ath (unregistered) in reply to SCB
    SCB:
    Tiago "pacman" Peczenyj:
    function myRandom(){ return 9; }
    I feel an XKCD reference coming on... Something about dice... Must... resist...

    No, that's from Dilbert. https://mywebspace.wisc.edu/lnmaurer/web/minirng/Dilbert0001.jpg

    You were thinking of myRandom = 4. http://xkcd.com/221/

  • Anonymous (unregistered) in reply to ath
    ath:
    SCB:
    Tiago "pacman" Peczenyj:
    function myRandom(){ return 9; }
    I feel an XKCD reference coming on... Something about dice... Must... resist...
    No, that's from Dilbert. https://mywebspace.wisc.edu/lnmaurer/web/minirng/Dilbert0001.jpg

    You were thinking of myRandom = 4. http://xkcd.com/221/

    God damn it, I thought we were going to get through an entire comment section without a bloody xkcd reference. Thanks for destroying my faith in the community.
  • SR ** (unregistered) in reply to Anonymous
    Anonymous:
    God damn it, I thought we were going to get through an entire comment section without a bloody xkcd reference. Thanks for destroying my faith in the community.

    I enjoyed it. You don't have to click, y'know?

  • A different anonymous (unregistered) in reply to SR **

    Don't know about the other guy, but knowing that someone inevitably thinks such a fucking pretentious twat is clever enough to quote, that destroys my faith. And I don't need to click the link to see it festering with smug.

  • Bim Job (unregistered) in reply to Cornelius amabat Eucleides, mmMMMmm
    Cornelius amabat Eucleides:
    Bim Job:
    Contraxit hanc dum assidet Iuniae.

    I just like the way Google translate says:

    Google:
    We are not yet able to translate from Latin into English.
    That was entirely my point. How is some poor, minimum-wage, web-crawler supposed to solve a captcha phrase when Google can't even manage it?

    The weird thing is: if you type either my quotation or the original one into Google, there are 128 hits. The top one leads you to Pliny Epistulae 7 19, from which I'd imagine that it's fairly easy to retrieve a translation. After all, Google is close to replicating the Library of Alexandria, right?

    I'm sure the concept of "captcha pass phrases" is the New Best Thing. Offers from VCs hereby solicited.

    PS PHP is shit. There are people out there waiting for the other shoe to drop. Hey, it's Thanksgiving!

    Enjoy your tryptophan, guys! (I'm just off to enjoy mine.)

  • John Galt (unregistered) in reply to DOA

    I prefer the ayn.rand() function, which causes Atlas to shrug.

  • Anonymous (unregistered) in reply to John Galt
    John Galt:
    I prefer the ayn.rand() function, which causes Atlas to shrug.
    It was funny when the first commenter said it but not so much anymore.
  • Kaii (unregistered) in reply to Iie
    Iie:
    Isn't that what all the cache related HTTP headers are for? Appending a random number is a dirty hack to something that already has an elegant solution.
    This is partly true, but there are still cases in which using this construct makes sense.

    You cannot modify the HTTP headers for that SWF if it's loaded from another server where you cannot modify headers. (i.e.: not your own server)

    In fact, this does not apply to the WTF above. But there are use cases ;-)

    TRWTF is that i believe the programmer intended to generate some sort of unique request (for caching purposes) here but failed by using just an integer value between 100 and 999. (regardless the benefit of caching when you do it server-side)

    The random value used in the WTF leaves way too much chance for repeating the same result. He could have been using microtime() [PHP] or Date.getTime() [JS] to generate a more unique request.

    captcha: erat

  • Kaii (unregistered) in reply to Blakeyrat
    Blakeyrat:
    Praytell, why would the caching situation be any different if they were using Javascript for this?

    Like, if you add a URL param in the JS, the browser, "hah! a URL param! That JS, always kidding around!" and loads the cached copy anyway?

    Uhm.. I guess it's because the php code renders the javascript which is then cached by the browser and now contains a hardcoded request URL. the javascript rand() would be executed any time the page is displayed, thus each time generating one of 899 possible random request URLs.

    Regardless of what i said, i still believe the programmer failed fairly in his intent to generate a unique request and get around any caching of the SWF.

    captcha: wisi

  • Web 1.0 Guy (unregistered)

    It's not a WTF, it used to be common practice to avoid browser caching the swf file back in ... 2001? If you wanted to update the swf file a lot without changing HTML code (and the file name) it was the only way browsers would get that file again.

    I know, today we've got headers, caching information, but back then there was IE 6.0 (or earlier) with all its quirks and glitches, nobody even dreamt about full HTML compliance.

  • Hunter Fuller (unregistered)

    I would much prefer that this be done server-side because JS would break caching. Also, I use NoScript, so I appreciate pages that don't require JS to be enabled.

  • Anonymous Cow-Herd (unregistered) in reply to Yaba
    Yaba:
    Well, there is a significant difference: The user can disable JavaScript for security reasons - therefore it's safer to calculate the random number on the server side with PHP.

    Correct. That way, the user is guaranteed to disable a unique script each time.

  • Steve H (unregistered) in reply to You didn't see me right
    You didn't see me right:
    in b4 "all PHP devs are retards" or "this is why I wouldn't use PHP to put out my own mother if she was on fire"

    Except nobody ever says that here. Which makes you look a bit of a fool, I fear.

  • dolor (unregistered) in reply to modem1975
    modem1975:
    <trollinvasion><respectdemand>FRIST!</respectdemand>

    <sarcasm>And it is obvious to any code monkey that SERVER-SIDE randomness was key to this application's security</sarcasm></trollevasion>

    FTFY

  • a met (unregistered) in reply to JonsJava
    JonsJava:
    Captcha: valetudo Can you use that in a setence?

    Sure. "This setence uses the word valetudo."

  • a paratus (unregistered) in reply to SCB
    SCB:
    Tiago "pacman" Peczenyj:
    function myRandom(){ return 9; }
    I feel an XKCD reference coming on... Something about dice... Must... resist...

    What's so wrong about Dilbert?

Leave a comment on “A Random PHP Script”

Log In or post as a guest

Replying to comment #:

Log Out

« Return to Article