src/GoogleAuthenticator.php
private function codesEqual(string $known, string $given): bool
    {
        if (strlen($given) !== strlen($known)) {
            return false;
        }

        $res = 0;

        $knownLen = strlen($known);

        for ($i = 0; $i < $knownLen; ++$i) {
            $res |= (ord($known[$i]) ^ ord($given[$i]));
        }

        return $res === 0;
    }
private function codesEqual(string $known, string $given): bool
    {
        if (strlen($given) !== strlen($known)) {
            return false;
        }

        $res = 0;

        $knownLen = strlen($known);

        for ($i = 0; $i < $knownLen; ++$i) {
            $res |= (ord($known[$i]) ^ ord($given[$i]));
        }

        return $res === 0;
    }
private function codesEqual ( string $ known , string $ given ) : bool { if ( strlen ( $ given ) !== strlen ( $ known ) ) { return false ; } $ res = 0 ; $ knownLen = strlen ( $ known ) ; for ( $ i = 0 ; $ i < $ knownLen ; ++ $ i ) { $ res |= ( ord ( $ known [ $ i ] ) ^ ord ( $ given [ $ i ] ) ) ; } return $ res === 0 ; }
A constant time code comparison.

@param string $known known code
@param string $given code received from a user

@return bool

@see http://codereview.stackexchange.com/q/13512/6747
A constant time code comparison .