PHP 5.3: `if (strcmp($passwd, $_POST["passwd"]) == 0) { login(); }` is broken (danuxx.blogspot.com)

It's not the correct way to compare passwords anyway, since people can do timing attacks on any kind of direct string compare.

But this was a really clever exploit this guy found. Not too major, since only C programmers would use strcmp().