iio7

Wanted to post a 2025 version of this classic HN question, but with a focus on underrated channels.

For some reason the documentation does not mention this, but if you succeed in sending the null byte character to password_hash with the default Bcrypt algortihm, PHP with exit the application with a ValueError.

Normally the browser will encode the input, but you can force the issue using e.g. cURL:

printf "password=foo\0bar" | curl -X POST --data-binary @- https://example.com -H "Content-Type: application/x-www-form-urlencoded"

How do you deal with this issue?

Do you replace null byte characters or use e.g. the Argon2id algorithm to get around this problem?

We're a couple of guys who have build a SaaS (B2C) that provides a very customizable news aggregate with deep consideration for privacy and anonymity.

As such we have a lot of problems receiving payments because of VAT (we located in EU and have customers both in EU and outside as well). We do not require customers to sign up by name, address, etc.

We're thinking about switching to a donation-based model, but are worried about whether we can actually survive on that.

So, can a SaaS survive on a donation-based model or will people just generally free-load?