140

What is the best way to generate an MD5 (or any other hash) of a multi-dimensional array?

I could easily write a loop which would traverse through each level of the array, concatenating each value into a string, and simply performing the MD5 on the string.

However, this seems cumbersome at best and I wondered if there was a funky function which would take a multi-dimensional array, and hash it.

14 Answers 14

298

(Copy-n-paste-able function at the bottom)

As mentioned prior, the following will work.

md5(serialize($array));

However, it's worth noting that (ironically) json_encode performs noticeably faster:

md5(json_encode($array));

In fact, the speed increase is two-fold here as (1) json_encode alone performs faster than serialize, and (2) json_encode produces a smaller string and therefore less for md5 to handle.

Edit: Here is evidence to support this claim:

<?php //this is the array I'm using -- it's multidimensional.
$array = unserialize('a:6:{i:0;a:0:{}i:1;a:3:{i:0;a:0:{}i:1;a:0:{}i:2;a:3:{i:0;a:0:{}i:1;a:0:{}i:2;a:0:{}}}i:2;s:5:"hello";i:3;a:2:{i:0;a:0:{}i:1;a:0:{}}i:4;a:1:{i:0;a:1:{i:0;a:1:{i:0;a:1:{i:0;a:1:{i:0;a:1:{i:0;a:0:{}}}}}}}i:5;a:5:{i:0;a:0:{}i:1;a:4:{i:0;a:0:{}i:1;a:0:{}i:2;a:3:{i:0;a:0:{}i:1;a:0:{}i:2;a:0:{}}i:3;a:6:{i:0;a:0:{}i:1;a:3:{i:0;a:0:{}i:1;a:0:{}i:2;a:3:{i:0;a:0:{}i:1;a:0:{}i:2;a:0:{}}}i:2;s:5:"hello";i:3;a:2:{i:0;a:0:{}i:1;a:0:{}}i:4;a:1:{i:0;a:1:{i:0;a:1:{i:0;a:1:{i:0;a:1:{i:0;a:1:{i:0;a:0:{}}}}}}}i:5;a:5:{i:0;a:0:{}i:1;a:3:{i:0;a:0:{}i:1;a:0:{}i:2;a:3:{i:0;a:0:{}i:1;a:0:{}i:2;a:0:{}}}i:2;s:5:"hello";i:3;a:2:{i:0;a:0:{}i:1;a:0:{}}i:4;a:1:{i:0;a:1:{i:0;a:1:{i:0;a:1:{i:0;a:1:{i:0;a:1:{i:0;a:0:{}}}}}}}}}}i:2;s:5:"hello";i:3;a:2:{i:0;a:0:{}i:1;a:0:{}}i:4;a:1:{i:0;a:1:{i:0;a:1:{i:0;a:1:{i:0;a:1:{i:0;a:1:{i:0;a:0:{}}}}}}}}}');

//The serialize test
$b4_s = microtime(1);
for ($i=0;$i<10000;$i++) {
    $serial = md5(serialize($array));
}
echo 'serialize() w/ md5() took: '.($sTime = microtime(1)-$b4_s).' sec<br/>';

//The json test
$b4_j = microtime(1);
for ($i=0;$i<10000;$i++) {
    $serial = md5(json_encode($array));
}
echo 'json_encode() w/ md5() took: '.($jTime = microtime(1)-$b4_j).' sec<br/><br/>';
echo 'json_encode is <strong>'.( round(($sTime/$jTime)*100,1) ).'%</strong> faster with a difference of <strong>'.($sTime-$jTime).' seconds</strong>';

JSON_ENCODE is consistently over 250% (2.5x) faster (often over 300%) -- this is not a trivial difference. You may see the results of the test with this live script here:

Now, one thing to note is array(1,2,3) will produce a different MD5 as array(3,2,1). If this is NOT what you want. Try the following code:

//Optionally make a copy of the array (if you want to preserve the original order)
$original = $array;

array_multisort($array);
$hash = md5(json_encode($array));

Edit: There's been some question as to whether reversing the order would produce the same results. So, I've done that (correctly) here:

As you can see, the results are exactly the same. Here's the (corrected) test originally created by someone related to Drupal:

And for good measure, here's a function/method you can copy and paste (tested in 5.3.3-1ubuntu9.5):

function array_md5(Array $array) {
    //since we're inside a function (which uses a copied array, not 
    //a referenced array), you shouldn't need to copy the array
    array_multisort($array);
    return md5(json_encode($array));
}
13
  • 48
    LOL! Really? I got down voted for "over" optimization? In reality, PHP's serialize is significantly slower. I'll update my answer with evidence... Commented Oct 12, 2011 at 14:03
  • 19
    What Nathan has done here is valuable even if one cannot see the value of it. It may be a valuable optimization in some situations that are outside of our context. Micro optimization is a poor decision in some but not all situations
    – SeanDowney
    Commented Aug 3, 2012 at 23:47
  • 14
    I am not one for micro-optimization for the sake of it, but where there is a documented performance increase for no extra work, then why not use it.
    – bumperbox
    Commented Oct 6, 2012 at 22:50
  • 2
    Actually, it looks like it depends on how deep the array is. I happen to need something that needs to run as fast as possible and while your POC shows that json_encode() is ~300% faster, when I changed the $array variable in your code to my use-case, it returned serialize() w/ md5() took: 0.27773594856262 sec json_encode() w/ md5() took: 0.34809803962708 sec json_encode is (79.8%) faster with a difference of (-0.070362091064453 seconds) (the precent calculation is obviously incorrect). My array is up to 2 levels deep, so just keep in mind that (as usual) your milage may vary.
    – samitny
    Commented Nov 8, 2012 at 15:26
  • 3
    Okay, I don't see why Nathan's answer is not the top answer. Seriously, use serialize and annoy your users with an immense slow site. Epic +1 @NathanJ.Brauer!
    – ReSpawN
    Commented Mar 27, 2014 at 9:24
169
md5(serialize($array));
5
  • 15
    if for some reason you want to match the hash (fingerprint) you may want to consider sorting the array "sort" or "ksort", additionally implementing some sort of scrubbing/cleaning might be needed as well
    – farinspace
    Commented May 11, 2011 at 18:15
  • 10
    Serialize is soooooooo much slower than json_encode from second answer. Do your server a pleasure and use json_encode! :)
    – s3m3n
    Commented May 5, 2013 at 17:19
  • 3
    It seems like you need to benchmark your own array in order to figure out if you should use json_encode or serialize. Depending on the array it differs.
    – akahunahi
    Commented Jan 23, 2014 at 21:07
  • i believe it's a wrong way, please check my explanation below.
    – TermiT
    Commented Oct 28, 2014 at 18:12
  • 1
    @joelpittet - Nope. Both examples in that drupal link have bugs. See the comments in my answer below. ;) E.g. dl.dropboxusercontent.com/u/4115701/Screenshots/… Commented Jun 11, 2015 at 6:36
29

I'm joining a very crowded party by answering, but there is an important consideration that none of the extant answers address. The value of json_encode() and serialize() both depend upon the order of elements in the array!

Here are the results of not sorting and sorting the arrays, on two arrays with identical values but added in a different order (code at bottom of post):

    serialize()
1c4f1064ab79e4722f41ab5a8141b210
1ad0f2c7e690c8e3cd5c34f7c9b8573a

    json_encode()
db7178ba34f9271bfca3a05c5dddf502
c9661c0852c2bd0e26ef7951b4ca9e6f

    Sorted serialize()
1c4f1064ab79e4722f41ab5a8141b210
1c4f1064ab79e4722f41ab5a8141b210

    Sorted json_encode()
db7178ba34f9271bfca3a05c5dddf502
db7178ba34f9271bfca3a05c5dddf502

Therefore, the two methods that I would recommend to hash an array would be:

// You will need to write your own deep_ksort(), or see
// my example below

md5(   serialize(deep_ksort($array)) );

md5( json_encode(deep_ksort($array)) );

The choice of json_encode() or serialize() should be determined by testing on the type of data that you are using. By my own testing on purely textual and numerical data, if the code is not running a tight loop thousands of times then the difference is not even worth benchmarking. I personally use json_encode() for that type of data.

Here is the code used to generate the sorting test above:

$a = array();
$a['aa'] = array( 'aaa'=>'AAA', 'bbb'=>'ooo', 'qqq'=>'fff',);
$a['bb'] = array( 'aaa'=>'BBBB', 'iii'=>'dd',);

$b = array();
$b['aa'] = array( 'aaa'=>'AAA', 'qqq'=>'fff', 'bbb'=>'ooo',);
$b['bb'] = array( 'iii'=>'dd', 'aaa'=>'BBBB',);

echo "    serialize()\n";
echo md5(serialize($a))."\n";
echo md5(serialize($b))."\n";

echo "\n    json_encode()\n";
echo md5(json_encode($a))."\n";
echo md5(json_encode($b))."\n";



$a = deep_ksort($a);
$b = deep_ksort($b);

echo "\n    Sorted serialize()\n";
echo md5(serialize($a))."\n";
echo md5(serialize($b))."\n";

echo "\n    Sorted json_encode()\n";
echo md5(json_encode($a))."\n";
echo md5(json_encode($b))."\n";

My quick deep_ksort() implementation, fits this case but check it before using on your own projects:

/*
* Sort an array by keys, and additionally sort its array values by keys
*
* Does not try to sort an object, but does iterate its properties to
* sort arrays in properties
*/
function deep_ksort($input)
{
    if ( !is_object($input) && !is_array($input) ) {
        return $input;
    }

    foreach ( $input as $k=>$v ) {
        if ( is_object($v) || is_array($v) ) {
            $input[$k] = deep_ksort($v);
        }
    }

    if ( is_array($input) ) {
        ksort($input);
    }

    // Do not sort objects

    return $input;
}
0
16

Answer is highly depends on data types of array values. For big strings use:

md5(serialize($array));

For short strings and integers use:

md5(json_encode($array));

4 built-in PHP functions can transform array to string: serialize(), json_encode(), var_export(), print_r().

Notice: json_encode() function slows down while processing associative arrays with strings as values. In this case consider to use serialize() function.

Test results for multi-dimensional array with md5-hashes (32 char) in keys and values:

Test name       Repeats         Result          Performance     
serialize       10000           0.761195 sec    +0.00%
print_r         10000           1.669689 sec    -119.35%
json_encode     10000           1.712214 sec    -124.94%
var_export      10000           1.735023 sec    -127.93%

Test result for numeric multi-dimensional array:

Test name       Repeats         Result          Performance     
json_encode     10000           1.040612 sec    +0.00%
var_export      10000           1.753170 sec    -68.47%
serialize       10000           1.947791 sec    -87.18%
print_r         10000           9.084989 sec    -773.04%

Associative array test source. Numeric array test source.

2
  • Can you please explain what are big and short strings?
    – A.L
    Commented Oct 21, 2015 at 16:25
  • 1
    @A.L short strings - strings that contains less than 25-30 chars. big strings - all containing more than 25-30 chars. Commented Oct 22, 2015 at 7:39
7

Aside from Brock's excellent answer (+1), any decent hashing library allows you to update the hash in increments, so you should be able to update with each string sequentially, instead having to build up one giant string.

See: hash_update

5
  • it's worth noting, that this method is inefficient if you're updating with tiny fragments; it's good for big chunks of huge files though.
    – wrygiel
    Commented Sep 15, 2012 at 18:41
  • @wrygiel That is not true. For MD5, compression is always done in 64-byte blocks (no matter what the size of your "big chunks" are), and, if you haven't yet filled up a block, no processing happens until the block is filled up. (When you finalise the hash, the last block is padded up to a full block, as part of final processing.) For more background, read Merkle-Damgard construction (which MD5, SHA-1, and SHA-2 are all based on). Commented Sep 16, 2012 at 1:06
  • You're right. I was totally misled by a comment on some other site.
    – wrygiel
    Commented Sep 20, 2012 at 7:54
  • @wrygiel That's why it pays to do your own research when following an idea "found on the Internet". ;-) In so saying, that last comment was easy for me to write, because I actually implemented MD5 from scratch a few years ago (to practise my Scheme programming skills), so I know its workings very well. Commented Sep 20, 2012 at 12:54
  • This is exactly what I want. Move and copy big truck of data in memory is not acceptable sometimes. So like other answers using serialize() is a very bad idea in terms of performance. But this API still missing if I only want to hash part of the String from a certain offset. Commented Oct 1, 2015 at 14:16
4
md5(serialize($array));

Will work, but the hash will change depending on the order of the array (that might not matter though).

3

Note that serialize and json_encode act differently when it comes to numeric arrays where the keys don't start at 0, or associative arrays. json_encode will store such arrays as an Object, so json_decode returns an Object, where unserialize will return an array with exact the same keys.

3

I think that this could be a good tip:

Class hasharray {

    public function array_flat($in,$keys=array(),$out=array()){
        foreach($in as $k => $v){
            $keys[] = $k; 
            if(is_array($v)){
                $out = $this->array_flat($v,$keys,$out);
            }else{
                $out[implode("/",$keys)] = $v;
            }
            array_pop($keys);
        }
        return $out;  
    }

    public function array_hash($in){
        $a = $this->array_flat($in);
        ksort($a);
        return md5(json_encode($a));
    }

}

$h = new hasharray;
echo $h->array_hash($multi_dimensional_array);
3

I didn't see the solution so easily above so I wanted to contribute a simpler answer. For me, I was getting the same key until I used ksort (key sort):

Sorted first with Ksort, then performed sha1 on a json_encode:

ksort($array)
$hash = sha1(json_encode($array) //be mindful of UTF8

example:

$arr1 = array( 'dealer' => '100', 'direction' => 'ASC', 'dist' => '500', 'limit' => '1', 'zip' => '10601');
ksort($arr1);

$arr2 = array( 'direction' => 'ASC', 'limit' => '1', 'zip' => '10601', 'dealer' => '100', 'dist' => '5000');
ksort($arr2);

var_dump(sha1(json_encode($arr1)));
var_dump(sha1(json_encode($arr2)));

Output of altered arrays and hashes:

string(40) "502c2cbfbe62e47eb0fe96306ecb2e6c7e6d014c"
string(40) "b3319c58edadab3513832ceeb5d68bfce2fb3983"
1
  • $sign = sha1(json_encode($data)); I ended up using sha1 as well, as it seems more unique.
    – Hebe
    Commented Dec 4, 2020 at 20:23
2

Important note about serialize()

I don't recommend to use it as part of hashing function because it can return different result for the following examples. Check the example below:

Simple example:

$a = new \stdClass;
$a->test = 'sample';

$b = new \stdClass;
$b->one = $a;
$b->two = clone $a;

Produces

"O:8:"stdClass":2:{s:3:"one";O:8:"stdClass":1:{s:4:"test";s:6:"sample";}s:3:"two";O:8:"stdClass":1:{s:4:"test";s:6:"sample";}}"

But the following code:

<?php

$a = new \stdClass;
$a->test = 'sample';

$b = new \stdClass;
$b->one = $a;
$b->two = $a;

Output:

"O:8:"stdClass":2:{s:3:"one";O:8:"stdClass":1:{s:4:"test";s:6:"sample";}s:3:"two";r:2;}"

So instead of second object php just create link "r:2;" to the first instance. It's definitely good and correct way to serialize data, but it can lead to the issues with your hashing function.

2
// Convert nested arrays to a simple array
$array = array();
array_walk_recursive($input, function ($a) use (&$array) {
    $array[] = $a;
});

sort($array);

$hash = md5(json_encode($array));

----

These arrays have the same hash:
$arr1 = array(0 => array(1, 2, 3), 1, 2);
$arr2 = array(0 => array(1, 3, 2), 1, 2);
1

there are several answers telling to use json_code,

but json_encode don't work fine with iso-8859-1 string, as soon as there is a special char, the string is cropped.

i would advice to use var_export :

md5(var_export($array, true))

not as slow as serialize, not as bugged as json_encode

1
  • Not so fast, best options is to use md4, var_export is also slow
    – user956584
    Commented Aug 10, 2015 at 19:53
1

Currently the most up-voted answer md5(serialize($array)); doesn't work well with objects.

Consider code:

 $a = array(new \stdClass());
 $b = array(new \stdClass());

Even though arrays are different (they contain different objects), they have same hash when using md5(serialize($array));. So your hash is useless!

To avoid that problem, you can replace objects with result of spl_object_hash() before serializing. You also should do it recursively if your array has multiple levels.

Code below also sorts arrays by keys, as dotancohen have suggested.

function replaceObjectsWithHashes(array $array)
{
    foreach ($array as &$value) {
        if (is_array($value)) {
            $value = $this->replaceObjectsInArrayWithHashes($value);
        } elseif (is_object($value)) {
            $value = spl_object_hash($value);
        }
    }
    ksort($array);
    return $array;
}

Now you can use md5(serialize(replaceObjectsWithHashes($array))).

(Note that the array in PHP is value type. So replaceObjectsWithHashes function DO NOT change original array.)

1
  • I totally agree. ` serialize(\stdClass())=== serialize(\stdClass());` Commented Nov 8, 2021 at 20:45
0

in some case maybe it's better to use http_build_query to convert array to string :

md5( http_build_query( $array ) );

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.