note 110113 deleted from function.strcmp by googleguy

Note Submitter: Chris ---- If you're comparing passwords, password hashes, etc., it may be possible for an attacker to determine the password by timing how long your program takes to compare strings. See http://en.wikipedia.org/wiki/Timing_attack and http://www.fosslc.org/drupal/content/everything-you-need-know-about-cryptography-1-hour (skip to minute 25). Here's a safer way to securely compare strings: <?php $hash1 = // user's pw hash from DB $hash2 = // hash of user-entered pw for($hash1 = hash('sha256', $hash1), $hash2 = hash('sha256', $hash2), $len = strlen($hash1), $result = $index = 0; $index < $len; $index++) { $result |= ord($hash1[$index]) ^ ord($hash2[$index]); usleep(mt_rand(0, 1)); } echo "strings ", $result === 0 ? null : 'do not', ' match'; ?> The hash functions in the for loop insure that the strings to compare are the same length.