Description:
------------
The comment by "thegreatall at gmail dot com" on the manual page for mt_rand() describes a method for quickly generating a pseudo-random salt for password hashes. One of the constants given in the example is incorrect and can lead a smaller range from which the random numbers will be selected.

The line -

  base_convert(mt_rand(0x1679616, 0x39AA3FF, 10, 36);

- should be changed to either -

  base_convert(mt_rand(1679616, 0x39AA3FF, 10, 36);

- or, if we want to keep the hex format, to -

  base_convert(mt_rand(0x19A100, 0x39AA3FF, 10, 36);

Rationale: the number 0x19A100 (= 1679616 in decimal) will be represented as 10000 in base-36, which is the intended value, whereas the given number 0x1679616 will be represented as e13iu in base-36.

Comment ID: 102318
Link: http://php.net/manual/en/function.mt-rand.php#102318