diff --git a/auth/db/auth.php b/auth/db/auth.php
index 9d3cc18c63e..96aad433f12 100644
--- a/auth/db/auth.php
+++ b/auth/db/auth.php
@@ -131,11 +131,11 @@ class auth_plugin_db extends auth_plugin_base {
             $authdb->Close();
 
             if ($this->config->passtype === 'plaintext') {
-                return ($fromdb == $extpassword);
+                return ($fromdb === $extpassword);
             } else if ($this->config->passtype === 'md5') {
-                return (strtolower($fromdb) == md5($extpassword));
+                return (strtolower($fromdb) === md5($extpassword));
             } else if ($this->config->passtype === 'sha1') {
-                return (strtolower($fromdb) == sha1($extpassword));
+                return (strtolower($fromdb) === sha1($extpassword));
             } else if ($this->config->passtype === 'saltedcrypt') {
                 return password_verify($extpassword, $fromdb);
             } else {
diff --git a/auth/db/tests/db_test.php b/auth/db/tests/db_test.php
index 1de432c3f17..68db9f83454 100644
--- a/auth/db/tests/db_test.php
+++ b/auth/db/tests/db_test.php
@@ -335,12 +335,28 @@ class auth_db_testcase extends advanced_testcase {
         $DB->update_record('auth_db_users', $user3);
         $this->assertTrue($auth->user_login('u3', 'heslo'));
 
+        // Test user created to see if the checking happens strictly.
+        $usermd5 = (object)['name' => 'usermd5', 'pass' => '0e462097431906509019562988736854'];
+        $usermd5->id = $DB->insert_record('auth_db_users', $usermd5);
+
+        // md5('240610708') === '0e462097431906509019562988736854'.
+        $this->assertTrue($auth->user_login('usermd5', '240610708'));
+        $this->assertFalse($auth->user_login('usermd5', 'QNKCDZO'));
+
         set_config('passtype', 'sh1', 'auth_db');
         $auth->config->passtype = 'sha1';
         $user3->pass = sha1('heslo');
         $DB->update_record('auth_db_users', $user3);
         $this->assertTrue($auth->user_login('u3', 'heslo'));
 
+        // Test user created to see if the checking happens strictly.
+        $usersha1 = (object)['name' => 'usersha1', 'pass' => '0e66507019969427134894567494305185566735'];
+        $usersha1->id = $DB->insert_record('auth_db_users', $usersha1);
+
+        // sha1('aaroZmOk') === '0e66507019969427134894567494305185566735'.
+        $this->assertTrue($auth->user_login('usersha1', 'aaroZmOk'));
+        $this->assertFalse($auth->user_login('usersha1', 'aaK1STfY'));
+
         set_config('passtype', 'saltedcrypt', 'auth_db');
         $auth->config->passtype = 'saltedcrypt';
         $user3->pass = password_hash('heslo', PASSWORD_BCRYPT);