code: static function stringEquals($a, $b)
      {
          // Be strict with arguments.  PHP's liberal types could get us pwned.
          if (func_num_args() !== 2) {
              throw new \InvalidArgumentException("Expecting 2 args, got ".func_num_args().".");
          }
          Checker::argString("a", $a);
          Checker::argString("b", $b);
  
          $len = strlen($a);
          if (strlen($b) !== $len) return false;
  
          $result = 0;
          for ($i = 0; $i < $len; $i++) {
              $result |= ord($a[$i]) ^ ord($b[$i]);
          }
          return $result === 0;
      }
docs: A string equality function that compares strings in a way that isn't suceptible to timing
  attacks.  An attacker can figure out the length of the string, but not the string's value.
  
  Use this when comparing two strings where:
  - one string could be influenced by an attacker
  - the other string contains data an attacker shouldn't know
  
  @param string $a
  @param string $b
  @return bool