public static function equal(string $known, string $given): bool
    {
        // Create some entropy
        $nonce = \random_bytes(32);

        // We hash the 2 inputs at this point because hash_equals is still 
        // vulnerable to timing attacks when the inputs have different sizes.
        // Inputs are also cast to string like in symfony stringutils.
        $known = \hash_hmac('sha256', $known, $nonce, true);
        $given = \hash_hmac('sha256', $given, $nonce, true);

        return \hash_equals($known, $given);
    }
public static function equal(string $known, string $given): bool
    {
        // Create some entropy
        $nonce = \random_bytes(32);

        // We hash the 2 inputs at this point because hash_equals is still 
        // vulnerable to timing attacks when the inputs have different sizes.
        // Inputs are also cast to string like in symfony stringutils.
        $known = \hash_hmac('sha256', $known, $nonce, true);
        $given = \hash_hmac('sha256', $given, $nonce, true);

        return \hash_equals($known, $given);
    }
public static function equal ( string $ known , string $ given ) : bool { // Create some entropy $ nonce = \ random_bytes ( 32 ) ; // We hash the 2 inputs at this point because hash_equals is still  // vulnerable to timing attacks when the inputs have different sizes. // Inputs are also cast to string like in symfony stringutils. $ known = \ hash_hmac ( 'sha256' , $ known , $ nonce , true ) ; $ given = \ hash_hmac ( 'sha256' , $ given , $ nonce , true ) ; return \ hash_equals ( $ known , $ given ) ; }
Compares two strings in constant time. Strings are hashed before
comparison so information is not leaked when strings are not of
equal length.

@param string $known The string of known length to compare against
@param string $given The string that the user can control
@return bool
Compares two strings in constant time . Strings are hashed before comparison so information is not leaked when strings are not of equal length .