Loose Type Comparison (ARCH7138)

Key php.security.loose-type-comparison · Severity warning · Category security · CWE CWE-697

In PHP, loose equality (==) coerces types; cases like "0e123" == "0e456" return true. In a token or hash comparison this type juggling leads to an authentication bypass.

Incorrect

<?php
if ($_POST['token'] == $storedToken) { // bypassable via type juggling
    grantAccess();
}

Correct

<?php
if (hash_equals($storedToken, $_POST['token'])) { // constant-time, type-strict
    grantAccess();
}

Fix

In security comparisons use strict === instead of ==, or constant-time hash_equals() for secret values.