Use hash_equals() for comparing hashes, as it is also resistant to timing attacks. If you'd like, I can:

Attackers use these specific strings to . If a system compares a user-provided password hash to a stored hash using == , an attacker can provide an input like 223704217 . As long as the stored password also hashes to a 0e... format, the comparison will return true even if the passwords don't match. Comparison Guide Comparison Type Result for md5(223704217) Description Loose == true (if compared to 0 or 0e... ) Vulnerable. PHP converts the string to a float ( Strict === false Secure. Checks both the value and the data type. How to Fix It

Show you (like for SHA1 or SHA256). Explain the math behind why equals zero in PHP. Provide a code snippet of a secure login check. Magic Hash - PHP Dictionary! - Read the Docs

To prevent this vulnerability, always use operators or built-in secure hash comparison functions: Use === instead of == .