public static function secureCompare($userInput, $reference)
    {
        if (strlen($userInput) !== strlen($reference)) {
            // use $reference as reference for actual constant time
            $comparison = $reference ^ $reference;
            // this make sure the result will be false
            $result = 1;
        } else {
            $comparison = $userInput ^ $reference;
            $result     = 0;
        }

        $len = strlen($comparison);
        for ($i = $len - 1; $i >= 0; --$i) {
            $result |= ord($comparison[$i]);
        }

        return !$result;
    }
public static function secureCompare($userInput, $reference)
    {
        if (strlen($userInput) !== strlen($reference)) {
            // use $reference as reference for actual constant time
            $comparison = $reference ^ $reference;
            // this make sure the result will be false
            $result = 1;
        } else {
            $comparison = $userInput ^ $reference;
            $result     = 0;
        }

        $len = strlen($comparison);
        for ($i = $len - 1; $i >= 0; --$i) {
            $result |= ord($comparison[$i]);
        }

        return !$result;
    }
public static function secureCompare ( $ userInput , $ reference ) { if ( strlen ( $ userInput ) !== strlen ( $ reference ) ) { // use $reference as reference for actual constant time $ comparison = $ reference ^ $ reference ; // this make sure the result will be false $ result = 1 ; } else { $ comparison = $ userInput ^ $ reference ; $ result = 0 ; } $ len = strlen ( $ comparison ) ; for ( $ i = $ len - 1 ; $ i >= 0 ; -- $ i ) { $ result |= ord ( $ comparison [ $ i ] ) ; } return ! $ result ; }
Truly constant time string comparison for Timing Attack protection

Many implementations will stop after length comparison which can
leak length (not much I agree, but what topic is this?), or try to
be smart at failing to compare portion of the $reference which again
could leak $reference length

This method just goes through exactly the same number of operations
in every cases

@param string $userInput
@param string $reference

@return bool
Truly constant time string comparison for Timing Attack protection