Comment by shkkmo

except for strlen(str) != 0 doesn't really do much to fix the issue. At best all it does is mean you have to guess the first character.

If you are comparing byte by byte the correct code is:

  valid = true;
  for(i = 0; i < strlen(user_token); i++) {
    if(strlen(token) < i || user_token[i] != token[i]) valid = false;
  }
  if(strlen(token) != strlen(user_token)) valid = false;
  return valid;