Hi Rouven,
On Mon, Dec 23, 2013 at 2:08 AM, Rouven Weßling <me@rouvenwessling.de>wrote:
> I'd like to propose this RFC to introduce a time-constant string
> comparison function: https://wiki.php.net/rfc/timing_attack
>
> I will not open the voting before January 7 to account for ho
>
As you mentioned in code, users should not use when known or user supplied
string
is null.
How about add E_NOTICE error for that case?
If user shouldn't then we are better to warn them.
Comparison is good since it always does the same operation based on user
supplied
string. (Unless compiler does optimizations that I don't expect)
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net