String comparison using vs strcmp

Question

It seems that PHP s     operator is case sensitive  So is there a reason to use strcmp     Is it safe to do something like the following   if   password      password2

User · Answer

You can use strcmp   if you wish to order compare strings lexicographically  If you just wish to check for equality then    is just fine

User · Answer

Always remember  when comparing strings  you should use     operator  strict comparison  and not    operator  loose comparison

User · Answer

strcmp will return different values based on the environment it is running Linux Windows    The reason is the that it has a bug as the bug report says  https   bugs php net bug php id 53999  Please handle with care  Thank you

User · Answer

PHP Instead of using alphabetical sorting  use the ASCII value of the character to make the comparison  Lowercase letters have a higher ASCII value than capitals  It s better to use the identity operator     to make this sort of comparison  strcmp   is a function to perform binary safe string comparisons  It takes two strings as arguments and returns  lt  0 if str1 is less than str2    0 if str1 is greater than str2  and 0 if they are equal  There is also a case-insensitive version named strcasecmp   that first converts strings to lowercase and then compares them

User · Answer

Well  according to this php bug report   you can even get 0wned    lt  php       pass   isset   GET  pass        GET  pass                Query   pass    will authorize user       strcmp and strcasecmp both are prone to this hack     if   strcasecmp   pass   123456       0          echo  You successfully logged in             gt    It gives you a warning   but still bypass the comparison  You should be doing     as  postfuturist suggested

User · Answer

Summing up all answers         is a bad idea for string comparisons  It will give you  surprising  results in many cases   Don t trust it      is fine  and will give you the best performance  strcmp   should be used if you need to determine which string is  greater   typically for sorting operations

User · Answer

Using    might be dangerous   Note  that it would cast the variable to another data type if the two differs   Examples    echo  1     1      true     false   echo  1    true     true     false     As you can see  these two are from different types  but the result is true  which might not be what your code will expect   Using      however  is recommended as test shows that it s a bit faster than strcmp   and its case-insensitive alternative strcasecmp     Quick googling yells this speed comparison  http   snipplr com view 758

User · Answer

Also The function can help in sorting  To be more clear about sorting  strcmp   returns less than 0 if string1 sorts before string2  greater than 0 if string2 sorts before string1 or 0 if they are the same  For example    first string    aabo    second string    aaao   echo  n   strcmp  first string  second string     The function will return greater than zero  as aaao is sorting before aabo

User · Answer

if   password      password2          is not a safe thing to do when comparing passwords or password hashes where one of the inputs is user controlled  In that case it creates a timing oracle allowing an attacker to derive the actual password hash from execution time differences  Use if  hash equals  password   password2           instead  because hash equals performs  timing attack safe string comparison

User · Answer

The reason to use it is because strcmp     returns  lt  0 if str1 is less than str2    0 if str1 is greater than str2  and 0 if they are equal        only returns true or false  it doesn t tell you which is the  greater  string

User · Answer

strcmp   and     are both case sensitive but     is much faster  sample code  http   snipplr com view 758

User · Answer

You should never use    for string comparison      is OK    something   0  echo   password123      something     true     false     Just run the above code and you ll see why    something   0  echo   password123       something     true     false     Now  that s a little better

User · Answer

Don t use    in PHP  It will not do what you expect  Even if you are comparing strings to strings  PHP will implicitly cast them to floats and do a numerical comparison if they appear numerical   For example  1e3      1000  returns true  You should use     instead

[php] String comparison using '==' vs. 'strcmp()'

Examples related to php