code: public static function compare($hasha = "", $hashb = "")
  	{
  		// we want hashes_are_not_equal to be false by the end of this if the strings are identical
  
  		// if the strings are NOT equal length this will return true, else false
  		$hashes_are_not_equal = strlen($hasha) ^ strlen($hashb);
  
  		// compare the shortest of the two strings (the above line will still kick back a failure if the lengths weren't equal.  this just keeps us from over-flowing our strings when comparing
  		$length = min(strlen($hasha), strlen($hashb));
  		$hasha = substr($hasha, 0, $length);
  		$hashb = substr($hashb, 0, $length);
  
  		// iterate through the hashes comparing them character by character
  		// if a character does not match, then return true, so the hashes are not equal
  		for ($i = 0; $i < strlen($hasha); $i++) {
  			$hashes_are_not_equal += !(ord($hasha[$i]) === ord($hashb[$i]));
  		}
  
  		// if not hashes are not equal, then hashes are equal
  		return !$hashes_are_not_equal;
  	}
docs: Constant-time string comparison.  This comparison function is timing-attack safe
  
  @param string $hasha
  @param string $hashb
  @return bool