<?php

/**
 * @copyright  Frederic G. Østby
 * @license    http://www.makoframework.com/license
 */

namespace mako\security;

/**
 * Secure comparison.
 *
 * @author  Frederic G. Østby
 */

class Comparer
{
	/**
	 * Protected constructor since this is a static class.
	 *
	 * @access  protected
	 */

	protected function __construct()
	{
		// Nothing here
	}

	/**
	 * Timing attack safe string comparison. Returns TRUE if the two strings a equal and FALSE if not.
	 * 
	 * @access  public
	 * @param   string   $string1  String one
	 * @param   string   $string2  String two
	 * @return  boolean
	 */

	public static function compare($string1, $string2)
	{
		$string1 = (string) $string1;
		$string2 = (string) $string2;

		$string1Length = strlen($string1);
		$string2Length = strlen($string2);

		$minLength = min($string1Length, $string2Length);
		$maxLength = max($string1Length, $string2Length);

		$result = $string1Length ^ $string2Length;

		$string1 = str_pad($string1, $maxLength);
		$string2 = str_pad($string2, $maxLength);

		for($i = 0; $i < $maxLength; $i++)
		{
			$result |= ord($string1[$i]) ^ ord($string2[$i]);
		}

		return $result === 0;
	}
}
<?php

/**
 * @copyright  Frederic G. Østby
 * @license    http://www.makoframework.com/license
 */

namespace mako\security;

/**
 * Secure comparison.
 *
 * @author  Frederic G. Østby
 */

class Comparer
{
	/**
	 * Protected constructor since this is a static class.
	 *
	 * @access  protected
	 */

	protected function __construct()
	{
		// Nothing here
	}

	/**
	 * Timing attack safe string comparison. Returns TRUE if the two strings a equal and FALSE if not.
	 * 
	 * @access  public
	 * @param   string   $string1  String one
	 * @param   string   $string2  String two
	 * @return  boolean
	 */

	public static function compare($string1, $string2)
	{
		$string1 = (string) $string1;
		$string2 = (string) $string2;

		$string1Length = strlen($string1);
		$string2Length = strlen($string2);

		$minLength = min($string1Length, $string2Length);

		$result = $string1Length ^ $string2Length;

		for($i = 0; $i < $minLength; $i++)
		{
			$result |= ord($string1[$i]) ^ ord($string2[$i]);
		}

		return $result === 0;
	}
}
Revert "Ensure that comparison time isn't affected by different string lengths"
Revert "Ensure that comparison time isn't affected by different string lengths"

This reverts commit 3b67e0c2c953727b203a9caafb227b62b4b4c39a.
