src/CSRF.php
public static function compare($hasha = "", $hashb = "")
	{
		// we want hashes_are_not_equal to be false by the end of this if the strings are identical

		// if the strings are NOT equal length this will return true, else false
		$hashes_are_not_equal = strlen($hasha) ^ strlen($hashb);

		// compare the shortest of the two strings (the above line will still kick back a failure if the lengths weren't equal.  this just keeps us from over-flowing our strings when comparing
		$length = min(strlen($hasha), strlen($hashb));
		$hasha = substr($hasha, 0, $length);
		$hashb = substr($hashb, 0, $length);

		// iterate through the hashes comparing them character by character
		// if a character does not match, then return true, so the hashes are not equal
		for ($i = 0; $i < strlen($hasha); $i++) {
			$hashes_are_not_equal += !(ord($hasha[$i]) === ord($hashb[$i]));
		}

		// if not hashes are not equal, then hashes are equal
		return !$hashes_are_not_equal;
	}
public static function compare($hasha = "", $hashb = "")
	{
		// we want hashes_are_not_equal to be false by the end of this if the strings are identical

		// if the strings are NOT equal length this will return true, else false
		$hashes_are_not_equal = strlen($hasha) ^ strlen($hashb);

		// compare the shortest of the two strings (the above line will still kick back a failure if the lengths weren't equal.  this just keeps us from over-flowing our strings when comparing
		$length = min(strlen($hasha), strlen($hashb));
		$hasha = substr($hasha, 0, $length);
		$hashb = substr($hashb, 0, $length);

		// iterate through the hashes comparing them character by character
		// if a character does not match, then return true, so the hashes are not equal
		for ($i = 0; $i < strlen($hasha); $i++) {
			$hashes_are_not_equal += !(ord($hasha[$i]) === ord($hashb[$i]));
		}

		// if not hashes are not equal, then hashes are equal
		return !$hashes_are_not_equal;
	}
Constant-time string comparison.  This comparison function is timing-attack safe

@param string $hasha
@param string $hashb
@return bool