In the provided code snippet, what potential security vulnerabilities could arise from comparing usernames directly in the code?

Comparing usernames directly in the code can lead to a security vulnerability known as a timing attack. This is because comparing usernames character by character can leak information about the usernames, making it easier for attackers to guess valid usernames. To solve this issue, it is recommended to use a timing-safe string comparison function, such as hash_equals(), to compare usernames securely. 

// Securely compare usernames using hash_equals() function
$user_input = $_POST['username'];
$stored_username = "admin";

if (hash_equals($user_input, $stored_username)) {
    echo "Username is valid.";
} else {
    echo "Invalid username.";
}

Keywords

SQL injection user input validation password hashing prepared statements cross-site scripting

Related Questions