Weak randomness (ARCH7115)

Key php.security.weak-random · Severity warning · Category security · CWE CWE-338

Non-cryptographic generators like rand() or mt_rand() are predictable. Using them for values such as tokens, password reset keys, salts, or session ids lets attackers guess those values.

Incorrect

<?php
$token = '';
for ($i = 0; $i < 16; $i++) {
    $token .= dechex(mt_rand(0, 15));
}

Correct

<?php
$token = bin2hex(random_bytes(16));

Fix

Use the cryptographically secure random_bytes() or random_int() for security-sensitive values instead of mt_rand().