brute force string matching