code: public function compareString($expected, $actual)
      {
          if (!is_string($expected)) {
              throw new InvalidArgumentException('Expected expected value to be a string, ' . gettype($expected) . ' given.');
          }
  
          if (!is_string($actual)) {
              throw new InvalidArgumentException('Expected actual value to be a string, ' . gettype($actual) . ' given.');
          }
  
          if (function_exists('hash_equals')) {
              return hash_equals($expected, $actual);
          }
  
          $expected .= "\0";
          $actual .= "\0";
          $expectedLength = StringHelper::byteLength($expected);
          $actualLength = StringHelper::byteLength($actual);
          $diff = $expectedLength - $actualLength;
          for ($i = 0; $i < $actualLength; $i++) {
              $diff |= (ord($actual[$i]) ^ ord($expected[$i % $expectedLength]));
          }
  
          return $diff === 0;
      }
docs: Performs string comparison using timing attack resistant approach.
  @see http://codereview.stackexchange.com/questions/13512
  @param string $expected string to compare.
  @param string $actual user-supplied string.
  @return bool whether strings are equal.