The documentation for PHP’s hash_equals() (a string comparison function which is safe from timing attacks) says,
It is important to provide the user-supplied string as the second parameter, rather than the first.
Why is this?
-
1It's a duplicate of stackoverflow.com/questions/27911597/… – Arminius Apr 26 '17 at 22:34
-
See answer in duplicate question – ZZromanZZ Apr 30 '17 at 21:00
