A loose == comparison against a hash function result allows type juggling authentication bypass.
Use strict === comparison or hash_equals() for constant-time hash comparison.