framework/base/Security.php
public function compareString($expected, $actual)
    {
        if (!is_string($expected)) {
            throw new InvalidArgumentException('Expected expected value to be a string, ' . gettype($expected) . ' given.');
        }

        if (!is_string($actual)) {
            throw new InvalidArgumentException('Expected actual value to be a string, ' . gettype($actual) . ' given.');
        }

        if (function_exists('hash_equals')) {
            return hash_equals($expected, $actual);
        }

        $expected .= "\0";
        $actual .= "\0";
        $expectedLength = StringHelper::byteLength($expected);
        $actualLength = StringHelper::byteLength($actual);
        $diff = $expectedLength - $actualLength;
        for ($i = 0; $i < $actualLength; $i++) {
            $diff |= (ord($actual[$i]) ^ ord($expected[$i % $expectedLength]));
        }

        return $diff === 0;
    }
public function compareString($expected, $actual)
    {
        if (!is_string($expected)) {
            throw new InvalidArgumentException('Expected expected value to be a string, ' . gettype($expected) . ' given.');
        }

        if (!is_string($actual)) {
            throw new InvalidArgumentException('Expected actual value to be a string, ' . gettype($actual) . ' given.');
        }

        if (function_exists('hash_equals')) {
            return hash_equals($expected, $actual);
        }

        $expected .= "\0";
        $actual .= "\0";
        $expectedLength = StringHelper::byteLength($expected);
        $actualLength = StringHelper::byteLength($actual);
        $diff = $expectedLength - $actualLength;
        for ($i = 0; $i < $actualLength; $i++) {
            $diff |= (ord($actual[$i]) ^ ord($expected[$i % $expectedLength]));
        }

        return $diff === 0;
    }
public function compareString ( $ expected , $ actual ) { if ( ! is_string ( $ expected ) ) { throw new InvalidArgumentException ( 'Expected expected value to be a string, ' . gettype ( $ expected ) . ' given.' ) ; } if ( ! is_string ( $ actual ) ) { throw new InvalidArgumentException ( 'Expected actual value to be a string, ' . gettype ( $ actual ) . ' given.' ) ; } if ( function_exists ( 'hash_equals' ) ) { return hash_equals ( $ expected , $ actual ) ; } $ expected .= "\0" ; $ actual .= "\0" ; $ expectedLength = StringHelper :: byteLength ( $ expected ) ; $ actualLength = StringHelper :: byteLength ( $ actual ) ; $ diff = $ expectedLength - $ actualLength ; for ( $ i = 0 ; $ i < $ actualLength ; $ i ++ ) { $ diff |= ( ord ( $ actual [ $ i ] ) ^ ord ( $ expected [ $ i % $ expectedLength ] ) ) ; } return $ diff === 0 ; }
Performs string comparison using timing attack resistant approach.
@see http://codereview.stackexchange.com/questions/13512
@param string $expected string to compare.
@param string $actual user-supplied string.
@return bool whether strings are equal.
Performs string comparison using timing attack resistant approach .