Question

hash_equals( string $a,  string $b )

Timing attack safe string comparison

---

description

Compares two strings using the same time whether they’re equal or not.

This function was added in PHP 5.6.

Note: It can leak the length of a string when arguments of differing length are supplied.

---

参数

$a

(string) (Required) Expected string.

$b

(string) (Required) Actual, user supplied, string.

---

返回值

(bool) Whether strings are equal.

---

源代码

File: wp-includes/compat.php

function hash_equals( $a, $b ) {
	$a_length = strlen( $a );
	if ( $a_length !== strlen( $b ) ) {
		return false;
	}
	$result = 0;

	// Do not attempt to "optimize" this.
	for ( $i = 0; $i < $a_length; $i++ ) {
		$result |= ord( $a[ $i ] ) ^ ord( $b[ $i ] );
	}

	return $result === 0;
}

---

更新日志

Version	description
3.9.2	Introduced.

---

相关函数

Used By

• wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php: WP_REST_Posts_Controller::get_item_permissions_check()
• wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php: WP_REST_Posts_Controller::can_access_password_content()
• wp-includes/class-wp-customize-nav-menus.php: WP_Customize_Nav_Menus::render_nav_menu_partial()
• wp-includes/pluggable.php: wp_verify_nonce()
• wp-includes/pluggable.php: wp_check_password()
• wp-includes/pluggable.php: wp_validate_auth_cookie()
• wp-includes/user.php: check_password_reset_key()
• wp-includes/class-wp-customize-widgets.php: WP_Customize_Widgets::sanitize_widget_instance()
Show 3 more used by Hide more used by

---

User Contributed Notes