lib/Dropbox/Security.php
static function stringEquals($a, $b)
    {
        // Be strict with arguments.  PHP's liberal types could get us pwned.
        if (func_num_args() !== 2) {
            throw new \InvalidArgumentException("Expecting 2 args, got ".func_num_args().".");
        }
        Checker::argString("a", $a);
        Checker::argString("b", $b);

        $len = strlen($a);
        if (strlen($b) !== $len) return false;

        $result = 0;
        for ($i = 0; $i < $len; $i++) {
            $result |= ord($a[$i]) ^ ord($b[$i]);
        }
        return $result === 0;
    }
static function stringEquals($a, $b)
    {
        // Be strict with arguments.  PHP's liberal types could get us pwned.
        if (func_num_args() !== 2) {
            throw new \InvalidArgumentException("Expecting 2 args, got ".func_num_args().".");
        }
        Checker::argString("a", $a);
        Checker::argString("b", $b);

        $len = strlen($a);
        if (strlen($b) !== $len) return false;

        $result = 0;
        for ($i = 0; $i < $len; $i++) {
            $result |= ord($a[$i]) ^ ord($b[$i]);
        }
        return $result === 0;
    }
static function stringEquals ( $ a , $ b ) { // Be strict with arguments.  PHP's liberal types could get us pwned. if ( func_num_args ( ) !== 2 ) { throw new \ InvalidArgumentException ( "Expecting 2 args, got " . func_num_args ( ) . "." ) ; } Checker :: argString ( "a" , $ a ) ; Checker :: argString ( "b" , $ b ) ; $ len = strlen ( $ a ) ; if ( strlen ( $ b ) !== $ len ) return false ; $ result = 0 ; for ( $ i = 0 ; $ i < $ len ; $ i ++ ) { $ result |= ord ( $ a [ $ i ] ) ^ ord ( $ b [ $ i ] ) ; } return $ result === 0 ; }
A string equality function that compares strings in a way that isn't suceptible to timing
attacks.  An attacker can figure out the length of the string, but not the string's value.

Use this when comparing two strings where:
- one string could be influenced by an attacker
- the other string contains data an attacker shouldn't know

@param string $a
@param string $b
@return bool
A string equality function that compares strings in a way that isn t suceptible to timing attacks . An attacker can figure out the length of the string but not the string s value .