Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72023
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.182 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <52EECE85.6090904@sugarcrm.com>
References: <CAGa2bXbq1ttBz+hSk20-CkKWvDdHr5+8bBmc04Q22i7K2VSs+A@mail.gmail.com>
 <52EE1EDC.2010309@sugarcrm.com> <CAGa2bXZZ3ug3oWg_im5bHUDjo2EHVeBMqU0fvB4WU-4OZTMCuw@mail.gmail.com>
 <52EECE85.6090904@sugarcrm.com>
Date: Mon, 3 Feb 2014 08:07:09 +0900
Message-ID: <CAGa2bXbfp0UUKGiTOCq6=3F9shyY2U26Qn_W1vt8ur-pj56RvA@mail.gmail.com>
To: Stas Malyshev <smalyshev@sugarcrm.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e013d1a78d4af6d04f17479f5
Subject: Re: [PHP-DEV] Extending uniqid() or not?
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--089e013d1a78d4af6d04f17479f5
Content-Type: text/plain; charset=UTF-8

Hi Stas,

On Mon, Feb 3, 2014 at 8:02 AM, Stas Malyshev <smalyshev@sugarcrm.com>wrote:

>
> > My question is if we should extend uniqid() or add new function that
> > actually
> > generates safe ID string. We may add more description to uniqid() page,
>
> How mcrypt_create_iv is not safe? It generates a random string, you need
> a random string, what's unsafe in it?


It's safe as long as users do not use RAND as random source.

There are many use cases that users need secure random string and
there are many mistakes out there. I'm questioning if we should have
easy to use and easy to find function for it or not.

Better documentation is valid option rather than have a function.
Do you suggest documentation as a solution?

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--089e013d1a78d4af6d04f17479f5--