hash_equals
hash_equals ( $known_string, $user_string )
Parameters:- (string) known_string Expected string.
- (string) user_string Actual, user supplied, string.
Returns:- (bool) Whether strings are equal.
Defined at: - Introduced in WordPress: 3.9.2
- Deprecated in WordPress: —
Description
Timing attack safe string comparison.Compares two strings using the same time whether they're equal or not.
Note: It can leak the length of a string when arguments of differing length are supplied.
This function was added in PHP 5.6.
However, the Hash extension may be explicitly disabled on select servers.
As of PHP 7.4.0, the Hash extension is a core PHP extension and can no
longer be disabled.
I.e. when PHP 7.4.0 becomes the minimum requirement, this polyfill
can be safely removed.