src/CSRF.php
public static function compare($hasha = "", $hashb = "")
	{
		// we want hashes_are_not_equal to be false by the end of this if the strings are identical

		// if the strings are NOT equal length this will return true, else false
		$hashes_are_not_equal = strlen($hasha) ^ strlen($hashb);

		// compare the shortest of the two strings (the above line will still kick back a failure if the lengths weren't equal.  this just keeps us from over-flowing our strings when comparing
		$length = min(strlen($hasha), strlen($hashb));
		$hasha = substr($hasha, 0, $length);
		$hashb = substr($hashb, 0, $length);

		// iterate through the hashes comparing them character by character
		// if a character does not match, then return true, so the hashes are not equal
		for ($i = 0; $i < strlen($hasha); $i++) {
			$hashes_are_not_equal += !(ord($hasha[$i]) === ord($hashb[$i]));
		}

		// if not hashes are not equal, then hashes are equal
		return !$hashes_are_not_equal;
	}
public static function compare($hasha = "", $hashb = "")
	{
		// we want hashes_are_not_equal to be false by the end of this if the strings are identical

		// if the strings are NOT equal length this will return true, else false
		$hashes_are_not_equal = strlen($hasha) ^ strlen($hashb);

		// compare the shortest of the two strings (the above line will still kick back a failure if the lengths weren't equal.  this just keeps us from over-flowing our strings when comparing
		$length = min(strlen($hasha), strlen($hashb));
		$hasha = substr($hasha, 0, $length);
		$hashb = substr($hashb, 0, $length);

		// iterate through the hashes comparing them character by character
		// if a character does not match, then return true, so the hashes are not equal
		for ($i = 0; $i < strlen($hasha); $i++) {
			$hashes_are_not_equal += !(ord($hasha[$i]) === ord($hashb[$i]));
		}

		// if not hashes are not equal, then hashes are equal
		return !$hashes_are_not_equal;
	}
public static function compare ( $ hasha = "" , $ hashb = "" ) { // we want hashes_are_not_equal to be false by the end of this if the strings are identical // if the strings are NOT equal length this will return true, else false $ hashes_are_not_equal = strlen ( $ hasha ) ^ strlen ( $ hashb ) ; // compare the shortest of the two strings (the above line will still kick back a failure if the lengths weren't equal.  this just keeps us from over-flowing our strings when comparing $ length = min ( strlen ( $ hasha ) , strlen ( $ hashb ) ) ; $ hasha = substr ( $ hasha , 0 , $ length ) ; $ hashb = substr ( $ hashb , 0 , $ length ) ; // iterate through the hashes comparing them character by character // if a character does not match, then return true, so the hashes are not equal for ( $ i = 0 ; $ i < strlen ( $ hasha ) ; $ i ++ ) { $ hashes_are_not_equal += ! ( ord ( $ hasha [ $ i ] ) === ord ( $ hashb [ $ i ] ) ) ; } // if not hashes are not equal, then hashes are equal return ! $ hashes_are_not_equal ; }
Constant-time string comparison.  This comparison function is timing-attack safe

@param string $hasha
@param string $hashb
@return bool
Constant - time string comparison . This comparison function is timing - attack safe