Random String Function

Sharif

Is there a function in PHP that generates a random string of numbers and/or text and numbers?

Weedpacket

Can't think of one off the top of my head, and too lazy right now to look at the manual's string functions, but it would be pretty trivial to write one anyway.

LordShryku

http://www.php.net/rand would be the place to start

psolus21

When I created sessions for a small webportal I used a function to generate a random 64 character string to be placed in the database and compared to the cookie to keep a person logged in. It seemed pretty secure, but here's how I did it:

<?
     function GenString()
     {
          $id = md5( rand() ). md5( rand() );
          return $id;
     }

Each randomly generated number is hashed to a 32 character string of characters and integers.

shrug

drawmack

the above suggestion is a good one, depending on what you're looking for. If you're looking for random passwords or something else the user has to type then that it probably not a good solution though. You may want to try something like this:

<?php
  function rand_string($length) 
  {
      $retval = '';
      for($i=0;$i<$length;$i++) 
      {
          $which = rand(0,2);
          switch($which) 
          {
              //generate a number
              case 0:
                  $retval .= chr(rand(48,57));
                  break;
              //generate a capital letter
              case 1:
                  $retval .= chr(rand(65,90));
                  break;
              //generate a lower case letter
              case 2:
                  $retval .= chr(rand(97,122));
                  break;
          } //end switch
      } //end for
      return $retval;
  } //end rand_string
?>

In tests with 6 character strings this function generated 100,000 unique strings when run through a for loop and called 100,000 times - I'd say that's pretty random.

Sharif

The reason for me needing a random string is because I am trying to create a method where users can activate themselves by going through a link sent via email after registration. If I have a random string stored in the database as their activation code and cross match that with the link, I figure it is a secure way to activate users.

When I send the email, the url would hold the page for the activation, the random string, and their userid so people cannot just start typing in custom stuff.