public static function secureCompare($userInput, $reference)
    {
        if (strlen($userInput) !== strlen($reference)) {
            // use $reference as reference for actual constant time
            $comparison = $reference ^ $reference;
            // this make sure the result will be false
            $result = 1;
        } else {
            $comparison = $userInput ^ $reference;
            $result     = 0;
        }

        $len = strlen($comparison);
        for ($i = $len - 1; $i >= 0; --$i) {
            $result |= ord($comparison[$i]);
        }

        return !$result;
    }