PHP 5.3: `if (strcmp($passwd, $_POST["passwd"]) == 0) { login(); }` is broken

It's not the correct way to compare passwords anyway, since people can do timing attacks on any kind of direct string compare.

But this was a really clever exploit this guy found. Not too major, since only C programmers would use strcmp().