title: strcmp vs. == vs. === in PHP for checking hash equality
body: <p>I'm using <code>crypt()</code> to hash passwords in PHP, and am trying to work out the safest way of testing equality of the resulting hash when performing password checks.</p>
  
  <p>There are three options that I can see:</p>
  
  <p><strong>Option 1 - Double Equals</strong></p>
  
  <pre><code>function checkPassword($hash, $password)
  {
      return crypt($password, $hash) == $hash;
  }
  </code></pre>
  
  <p><strong>Option 2 - Triple Equals</strong></p>
  
  <pre><code>function checkPassword($hash, $password)
  {
      return crypt($password, $hash) === $hash;
  }
  </code></pre>
  
  <p><strong>Option 3 - <code>strcmp()</code></strong></p>
  
  <pre><code>function checkPassword($hash, $password)
  {
      return strcmp(crypt($password, $hash), $hash) === 0;
  }
  </code></pre>
  
  <p>My intuition tells me that option 1 is a bad idea, due to the lack of type checking, and that options 2 or 3 are likely to be better. However, I can't work out if there's a specific case that <code>===</code> or <code>strcmp</code> would fail under. Which is safest for this purpose?</p>