different sha1 checksum on different php versions?

Question

I run this script:

define('SECRET', "vJs;ly-W\XDkD_2'-M7S2/ZRRBobxt5");
echo sha1(SECRET . 'zcbkeyky' . '[email protected]') . "\n";

Locally with PHP 5.3.2 (cli) it gives me: 3baa47e50394cd2dce236dcbf2f409fdb9010f2a
On a remote machine with PHP 5.1.6 (cli) it gives: d1bcf4ea83e50593d3df19a8455a5f5cd32d63ef

Why does the same calculation differ?

Answer 1

I'd say the problem is here:

define('SECRET', "vJs;ly-W\XDkD_2'-M7S2/ZRRBobxt5");
//                        ^^-- escape character

PHP manual says:

\x[0-9A-Fa-f]{1,2} the sequence of characters matching the regular expression is a character in hexadecimal notation

Between PHP 5.2 and 5.3, apparently this was modified to also match \X[0-9A-Fa-f]{1,2} (note the capital X at the beginning). When running in PHP 5.3, you have (unknowingly?) a Carriage Return in your string.

Either a) replace the backslash with another character, or b) use single quotes when defining SECRET, and both versions will return the same hash (tried on 5.2.1 and 5.3.2).