gistfile1.txt

scott@debian ~ $ php -dmbstring.func_overload=2 sammy_test.php 
bool(true)
scott@debian ~ $ php sammy_test.php 
bool(false)

run_with_mbstring_func_overload.php

<?php
    function sammy_hash_equals($knownString, $userString)
    {
        $kLen = strlen($knownString);
        $uLen = strlen($userString);
        if ($kLen !== $uLen) {
            return false;
        }
        $result = 0;
        for ($i = 0; $i < $kLen; $i++) {
            $result |= (ord($knownString[$i]) ^ ord($userString[$i]));
        }
        // They are only identical strings if $result is exactly 0...
        return 0 === $result;
    }

// 4 chars but 16 bytes
$hashA = "\xF0\x9D\x92\xB3" . "\xF0\x9D\x92\xB3" . "\xF0\x9D\x92\xB3". "\xF0\x9D\x92\xB3";
$hashB = "\xF0\x9D\x92\xB3" . "\xF0\x9D\x92\xB4" . "\xF0\x9D\x92\xB4" . "\xF0\x9D\x92\xB4";

var_dump(sammy_hash_equals($hashA, $hashB));