Zennoxa Shield
Rules / PHP
SHIELD-PHP-016

Type juggling in loose comparison of hashes

highPHPCWE-697CVSS 8.1

What it detects

A loose == comparison against a hash function result allows type juggling authentication bypass.

How to fix

Use strict === comparison or hash_equals() for constant-time hash comparison.

Vulnerable — Shield flags thisverify.php
<?php
// verify the password-reset signature
function checkSignature(string $input, string $knownHash): bool {
    if (hash('sha256', $input) == $knownHash) {
        return true;
    }
    return false;
}
Fixed — scans cleanverify.php
<?php
// verify the password-reset signature
function checkSignature(string $input, string $knownHash): bool {
    return hash_equals($knownHash, hash('sha256', $input));
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PHP-016, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PHP-016: Type juggling in loose comparison of hashes — Zennoxa Shield