

PHP 5.3: `if (strcmp($passwd, $_POST["passwd"]) == 0) { login(); }` is broken - danielweber
http://danuxx.blogspot.com/2013/03/unauthorized-access-bypassing-php-strcmp.html

======
danielweber
It's not the correct way to compare passwords anyway, since people can do
timing attacks on any kind of direct string compare.

But this was a really clever exploit this guy found. Not too major, since only
C programmers would use strcmp().

