Comment by delinka

Let's make it somewhat more readable:

    int token_length = strlen(token);
    int input_length = strlen(input);
    int match_count = 0; // for constant-time comparison...
    
    // Just get this out of the way now; no need to dawdle
    // (because the length of a token is generally known)
    if (token_length != input_length) {
        return false;
    }
    
    // No need to worry about mismatched buffer lengths at this point
    for(int i=0; i<token_length; i++) {
        if (token[i] == input[i]) {
            match_count++;
        }
    }
    
    // if the same number of characters match, voila!
    return (match_count == token_length);

It takes far too long to understand the intent and verify the correctness of lines like:

    if(strlen(token) < i || user_token[i] != token[i]) valid = false;