PHP sha1() computes the SHA-1 message digest as hexadecimal text or raw binary bytes. The examples below show how the call behaves, where it is useful, and which limitations matter.
What Is sha1() in PHP?
Computes the SHA-1 message digest as hexadecimal text or raw binary bytes.
Its call structure is:
sha1($string, [$binary])The arguments identify the values or resources passed to sha1(). Read the examples with attention to the type of each supplied argument and to whether the function modifies its input or returns a separate result.
Example 1: Basic Usage
This example introduces sha1 with a direct call and a small, readable input.
<?php
echo sha1("sample message");Output:
7e5ee118ece79e5a2d22711a5bd0f30d617b4321Computes the SHA-1 message digest as hexadecimal text or raw binary bytes. SHA-1 is unsuitable for password storage or collision-resistant security; use password_hash() or a modern hash algorithm.
Example 2: Another Behavior or Input
Compare this input with the previous example: changing the data or option can affect how sha1 behaves.
<?php
echo strlen(sha1("sample message", true)); // 20 binary bytesOutput:
20The changed input illustrates why output may differ with the chosen values or environment. SHA-1 is unsuitable for password storage or collision-resistant security; use password_hash() or a modern hash algorithm.
Practical Example: Using the Feature
The following example incorporates sha1 into a workflow. Values such as paths, connection handles and configuration options must come from trusted application settings.
<?php
$bytes = file_get_contents("/path/to/example.txt");
if ($bytes !== false) { echo hash("sha256", $bytes); } // Prefer SHA-256 for integrity checks.In a real application, check each operation result, validate values before use and clean up acquired resources. SHA-1 is unsuitable for password storage or collision-resistant security; use password_hash() or a modern hash algorithm.
Important Behavior and Edge Cases
- Purpose: Computes the SHA-1 message digest as hexadecimal text or raw binary bytes.
- Key limitation: SHA-1 is unsuitable for password storage or collision-resistant security; use password_hash() or a modern hash algorithm.
- Failure handling: Check return values and handle invalid inputs and unavailable operating-system or extension features where relevant.
Comparison With Related Functions
| Function or Approach | Best Fit |
|---|---|
sha1() | Computes the SHA-1 message digest as hexadecimal text or raw binary bytes. |
hash("sha256", ...) | Calculates a SHA-256 digest, which has stronger collision resistance than SHA-1. |
Common Beginner Mistakes
| Mistake | Correct Approach |
|---|---|
| SHA-1 is unsuitable for password storage or collision-resistant security; use password_hash() or a modern hash algorithm. | The correct approach depends on this behavior: SHA-1 is unsuitable for password storage or collision-resistant security; use password_hash() or a modern hash algorithm. |
| Ignoring errors or cleanup after the operation. | Validate inputs and check each result; close files, restore settings or release resources when the operation requires it. |
Key Takeaways
- Computes the SHA-1 message digest as hexadecimal text or raw binary bytes.
- SHA-1 is unsuitable for password storage or collision-resistant security; use password_hash() or a modern hash algorithm.
- Use the examples as starting points, and adapt environmental paths, resources and permissions rather than assuming fixed results.
sha1 is useful when its specific behavior fits the problem. The safest implementations combine the correct API with input validation, error checking and resource cleanup.