src/GoogleAuthenticator.php
private function codesEqual(string $known, string $given): bool
    {
        if (strlen($given) !== strlen($known)) {
            return false;
        }

        $res = 0;

        $knownLen = strlen($known);

        for ($i = 0; $i < $knownLen; ++$i) {
            $res |= (ord($known[$i]) ^ ord($given[$i]));
        }

        return $res === 0;
    }
private function codesEqual(string $known, string $given): bool
    {
        if (strlen($given) !== strlen($known)) {
            return false;
        }

        $res = 0;

        $knownLen = strlen($known);

        for ($i = 0; $i < $knownLen; ++$i) {
            $res |= (ord($known[$i]) ^ ord($given[$i]));
        }

        return $res === 0;
    }
A constant time code comparison.

@param string $known known code
@param string $given code received from a user

@return bool

@see http://codereview.stackexchange.com/q/13512/6747