note 110113 added to function.strcmp

If you're comparing passwords, password hashes, etc., it may be possible for an attacker to determine the password by timing how long your program takes to compare strings. See http://en.wikipedia.org/wiki/Timing_attack and http://www.fosslc.org/drupal/content/everything-you-need-know-about-cryptography-1-hour (skip to minute 25). Here's a safer way to securely compare strings: <?php $hash1 = // user's pw hash from DB $hash2 = // hash of user-entered pw for($hash1 = hash('sha256', $hash1), $hash2 = hash('sha256', $hash2), $len = strlen($hash1), $result = $index = 0; $index < $len; $index++) { $result |= ord($hash1[$index]) ^ ord($hash2[$index]); usleep(mt_rand(0, 1)); } echo "strings ", $result === 0 ? null : 'do not', ' match'; ?> The hash functions in the for loop insure that the strings to compare are the same length. ---- Server IP: 69.147.83.199 Probable Submitter: 168.251.194.11 ---- Manual Page -- http://www.php.net/manual/en/function.strcmp.php Edit -- https://master.php.net/note/edit/110113 Del: integrated -- https://master.php.net/note/delete/110113/integrated Del: useless -- https://master.php.net/note/delete/110113/useless Del: bad code -- https://master.php.net/note/delete/110113/bad+code Del: spam -- https://master.php.net/note/delete/110113/spam Del: non-english -- https://master.php.net/note/delete/110113/non-english Del: in docs -- https://master.php.net/note/delete/110113/in+docs Del: other reasons-- https://master.php.net/note/delete/110113 Reject -- https://master.php.net/note/reject/110113 Search -- https://master.php.net/manage/user-notes.php