5 ms·
PHP 5.3: `if (strcmp($passwd, $_POST["passwd"]) == 0) { login(); }` is broken
- danielweber 14y agoIt's not the correct way to compare passwords anyway, since people can do timing attacks on any kind of direct string compare. But this was a really clever exploit this guy found. Not too major, since only C programmers would use strcmp().