The documentation for PHP’s hash_equals() (a string comparison function which is safe from timing attacks) says,

It is important to provide the user-supplied string as the second parameter, rather than the first.

Why is this?



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.