Note, that there is already a related RFC[1] including a
discussion on internals[2].

[1] <https://wiki.php.net/rfc/uniqid>
[2] <http://marc.info/?t=147339817200002&r=1&w=2>

The internals discussion ends with the idea of returning an UUID, which is exactly what the provided patch in this bug report does.

This has been discussed a couple of times already and the argument is basically always the same: We're don't want to change the uniqid output format for BC reasons. In particular changing the length is problematic, as uniqid output is stored in length-limited database fields (for example). Switching uniqid to use UUIDs would certainly cause breakage.

There is an active proposal to expose a UUID interface (without changing the uniqid function): https://wiki.php.net/rfc/uuid

I think what we should do here is deprecate uniqid() in favor of bin2hex(random_bytes(16)), or the proposed UUID interface.

Right, we have a double constraint: do not change output format for backward compatibility, but also change it to increase performance and uniqueness.

Some proposed to deprecate uniqid(), but this does not address the backward compatibility ptoblem, quite the contrary.

What about adding an uniqid.version option to php.ini to govern uniqid() behavior? Default would uniqid.version=0 for backward compatible behavior, and uniqid.version=1 would enable UUID output.

I updated the patch to just extract the nanosecond timestamp of UUID so that we do not introduce non digits in the output. That might have confused some script that do not expect it.

I also avoid goind the UUID way if more_entropy is set.

I just uploaded a third patch that improves the fix to the problem:
- uinqid() semantics is not altered: it still output a 14 digit unique identifier
- performance boost is obtained for all supported platforms, no uuidgen() support required.
- Cygwin requirement to use more_entropy=true can be removed

The idea is to poll time using gettimeofday() until the microsecond changes. On a modern system, that will cause a a few gettimeofday() system calls that last much shorter that usleep(1).

I measured a 10000-fold performance improvement on NetBSD, and I expect at least a 10-fold improvement on Linux.

This looks like a good approach. I tested your patch on Linux against a tight uniqid() loop and got an improvement of approximately 1000x.

One technical note: As written the code is not thread safe. The prev_tv variable should be declared as a thread-local variable. To avoid messing with TSRM globals, it can be declared as ZEND_TLS.

I uploaded an updated patch against git, using ZEND_TLS.