lib/Dropbox/Security.php
static function stringEquals($a, $b)
    {
        // Be strict with arguments.  PHP's liberal types could get us pwned.
        if (func_num_args() !== 2) {
            throw new \InvalidArgumentException("Expecting 2 args, got ".func_num_args().".");
        }
        Checker::argString("a", $a);
        Checker::argString("b", $b);

        $len = strlen($a);
        if (strlen($b) !== $len) return false;

        $result = 0;
        for ($i = 0; $i < $len; $i++) {
            $result |= ord($a[$i]) ^ ord($b[$i]);
        }
        return $result === 0;
    }
static function stringEquals($a, $b)
    {
        // Be strict with arguments.  PHP's liberal types could get us pwned.
        if (func_num_args() !== 2) {
            throw new \InvalidArgumentException("Expecting 2 args, got ".func_num_args().".");
        }
        Checker::argString("a", $a);
        Checker::argString("b", $b);

        $len = strlen($a);
        if (strlen($b) !== $len) return false;

        $result = 0;
        for ($i = 0; $i < $len; $i++) {
            $result |= ord($a[$i]) ^ ord($b[$i]);
        }
        return $result === 0;
    }
A string equality function that compares strings in a way that isn't suceptible to timing
attacks.  An attacker can figure out the length of the string, but not the string's value.

Use this when comparing two strings where:
- one string could be influenced by an attacker
- the other string contains data an attacker shouldn't know

@param string $a
@param string $b
@return bool