What best practices should be followed when comparing string values in PHP, especially in login authentication scripts?

When comparing string values in PHP, especially in login authentication scripts, it is important to use a secure method to prevent vulnerabilities such as timing attacks. The best practice is to use the hash_equals() function to compare the hashed password stored in the database with the hashed password entered by the user during login. This function compares two strings in a way that mitigates timing attacks, ensuring a secure comparison.

$storedPassword = "hashed_password_from_database";
$userPassword = "user_input_password";

if (hash_equals($storedPassword, crypt($userPassword, $storedPassword))) {
    // Passwords match
    // Proceed with login authentication
} else {
    // Passwords do not match
    // Handle incorrect password error
}