diff --git a/libraries/common.inc.php b/libraries/common.inc.php
index e1042c4aa0..5a171205ca 100644
--- a/libraries/common.inc.php
+++ b/libraries/common.inc.php
@@ -482,7 +482,7 @@ if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
  */
 $token_mismatch = true;
 if (PMA_isValid($_REQUEST['token'])) {
-    $token_mismatch = ($_SESSION[' PMA_token '] != $_REQUEST['token']);
+    $token_mismatch = ! hash_equals($_SESSION[' PMA_token '], $_REQUEST['token']);
 }
 
 if ($token_mismatch) {
diff --git a/libraries/core.lib.php b/libraries/core.lib.php
index 57e758a302..e909ad9a48 100644
--- a/libraries/core.lib.php
+++ b/libraries/core.lib.php
@@ -305,7 +305,7 @@ function PMA_warnMissingExtension($extension, $fatal = false, $extra = '')
         PMA_fatalError($message);
     } else {
         $GLOBALS['error_handler']->addError(
-            $message, 
+            $message,
             E_USER_WARNING,
             '',
             '',
@@ -799,4 +799,12 @@ function PMA_addJSVar($key, $value, $escape = true)
     PMA_addJSCode(PMA_getJsValue($key, $value, $escape));
 }
 
+/* Compatibility with PHP < 5.6 */
+if(! function_exists('hash_equals')) {
+    function hash_equals($a, $b) {
+        $ret = strlen($a) ^ strlen($b);
+        $ret |= array_sum(unpack("C*", $a ^ $b));
+        return ! $ret;
+    }
+}
 ?>