sodium_memcmp compares two byte strings in constant time when their lengths match.
The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.
What It Does
The operation is intended for: sodium_memcmp compares two byte strings in constant time when their lengths match.
The sodium extension must be enabled.
Syntax and Return Value
sodium_memcmp(string $string1, string $string2): int| Parameter | Purpose |
|---|---|
| $string1 (string) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
| $string2 (string) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
The declared return type is shown above. Errors can include false results or exceptions depending on this API: Encoding does not encrypt or authenticate data; exact byte lengths and formats still matter.
Example 1: Basic Operation
Inspect the output: this operation works on raw byte strings and does not by itself provide encryption.
<?php
$message = "Account update";
$tokenA = hash('sha256', $message, true);
$tokenB = hash('sha256', $message, true);
var_dump(sodium_memcmp($tokenA, $tokenB) === 0);Example 2: A Different Use Case
Inspect the output: this operation works on raw byte strings and does not by itself provide encryption.
<?php
// Check the alternative case.
$message = "New order: 42";
$tokenA = hash('sha256', $message, true);
$tokenB = hash('sha256', $message, true);
var_dump(sodium_memcmp($tokenA, $tokenB) === 0);Practical Example: Checking the Result
Inspect the output: this operation works on raw byte strings and does not by itself provide encryption.
<?php
// Verify the expected behavior before using results.
$message = "Export completed";
$tokenA = hash('sha256', $message, true);
$tokenB = hash('sha256', $message, true);
var_dump(sodium_memcmp($tokenA, $tokenB) === 0);Important Behavior and Edge Cases
Encoding does not encrypt or authenticate data; exact byte lengths and formats still matter.
Encoding does not encrypt or authenticate data; exact byte lengths and formats still matter.
Comparison with Related Functions
| Approach | Key distinction |
|---|---|
| sodium_memcmp | sodium_memcmp compares two byte strings in constant time when their lengths match. |
| Related technique | Cryptographic primitives such as secretbox and auth provide actual security properties. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Confusing this operation with a neighboring cryptographic or security mechanism | Cryptographic primitives such as secretbox and auth provide actual security properties. |
| Ignoring a security prerequisite or failure case | Encoding does not encrypt or authenticate data; exact byte lengths and formats still matter. |
Key Takeaways
- sodium_memcmp compares two byte strings in constant time when their lengths match.
- Encoding does not encrypt or authenticate data; exact byte lengths and formats still matter.
- Cryptographic primitives such as secretbox and auth provide actual security properties.
Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.