how to compare strings in solidity?

Question

pragma solidity ^0.4.11;
contract test2 
{

    address creater;
    string username;
    string password;

    function testusernamepassword(string username,string password) returns (bool) 
    {
        if (username == "deepak" && password == "123") //error: operator == is not compatible with string ?
        {
            return true;
        }
        else
        {
            return false;
        }
    }
}

Answer 1

You can compare strings like this:

function compareStrings(string memory a, string memory b) public view returns (bool) {
    return (keccak256(abi.encodePacked((a))) == keccak256(abi.encodePacked((b))));
}

As a side note: It's not secure at all dealing with passwords and usernames in Solidity.

Answer 2

Here's the simplest way:

keccak256(bytes(a)) == keccak256(bytes(b));

Just use keccak256() while converting the string to bytes.

Answer 3

Seems kind of expensive for strings that have a different length, which could be most of the time. What about this solution?

    function memcmp(bytes memory a, bytes memory b) internal pure returns(bool){
        return (a.length == b.length) && (keccak256(a) == keccak256(b));
    }
    function strcmp(string memory a, string memory b) internal pure returns(bool){
        return memcmp(bytes(a), bytes(b));
    }

Answer 4

Strings are not really a primitive type in Solidity. There are lots of things that are missing, a bit like in old C. They are a lot like a bytes array, so the low level of comparing would be to treat them as such and iterate over the arrays.

PabloRuiz's answer is a better choice.

If you want to know a little more about strings, you could try my blog post on that subject.

Regarding testing user names and passwords in Solidity, keep in mind that everything you send in a transaction is visible to everyone. The data can be retrieved from a blockchain explorer. The first thing you should try, at least, is to Hash the password, but even then, who ever finds the hash can copy it and relay it for themselves in a fake authentication. In non-blockchain systems, you'd usually use some kind of challenge-response setup. If you could give more details about your authentication setup, people here might be able to give some ideas around it.

Answer 5

This is a cleaner version of @pabloruiz55 version. The parenthesis are not necessary and the function can be pure.

// SPDX-License-Identifier: MIT

pragma solidity ^0.8.0;

contract StringComparison {

    function compareStrings(string memory a, string memory b) public pure returns (bool) {
        return keccak256(abi.encodePacked(a)) == keccak256(abi.encodePacked(b));
    }
}

Directly try out the code in Remix here.

Answer 6

If you're using Openzeppelin in your project, go ahead and use their function in Strings.sol library:

https://github.com/OpenZeppelin/openzeppelin-contracts/blob/6e214227376acd688e60fcdca8cb7f0ae8cef98f/contracts/utils/Strings.sol#L90-L92