PHP random string generator more random than expected

Question

I've been using this to gender a random 12 character string:

//  lost-in-code.com/programming/php-code/php-random-string-with-numbers-and-letters
$ch = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@$%^&(){}[]+=-_/?|*#";
$sc = "";    
for ($p = 0; $p < 12; $p++) {
    $sc .= $ch[mt_rand(0,82)];  // 83 is the strlen of characters
}

It turns out that it in practice it can include a space in the string. This was not expected!

Why would it be? Does it treat the underscore as a space? It's been causing random (and until now, untraceable) bugs.

Thanks.

$ch is not an array and space is not included in $ch. Um... — Raptor
– Raptor, Commented May 15, 2012 at 10:05
@ShivanRaptor $string[3] maps to specific characters in a string. — Dunhamzzz
– Dunhamzzz, Commented May 15, 2012 at 10:06

Shiplu Mokaddim · Accepted Answer · 2012-05-15 11:16:55Z

2

At a guess (not tested) change the quotes around the $ch string to single quotes. stops the braces from being "evaluated"

Edit:

Just to update after some testing - it's NOT converting "as is" - so there's something else in the code that's causing problems. Just ran it over 100,000 times without spaces.

Still put as single quotes to rule that issue out (you may have other variables that are getting evaluated) but that alone is not the issue.

Danger characters are described here

edited May 15, 2012 at 11:16

Shiplu Mokaddim

57.5k20 gold badges147 silver badges193 bronze badges

answered May 15, 2012 at 10:07

Robbie

17.7k4 gold badges40 silver badges75 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

user128161 Over a year ago

I agree, it could be that $% is being evaluated, either escape that character or use single quotes

Raptor Over a year ago

Use single quote for $ch to avoid parsing of its contents.

Shiplu Mokaddim Over a year ago

No it does not evaluate $%. I have tested.

Nick Over a year ago

So what are the danger characters in the string, then? It gets passed as JSON, for instance, so I've considered killing braces anyway.

Eugene · Accepted Answer · 2012-05-15 10:34:41Z

1

Your function looks good. I think that the possible scenario is that you apply some decoding function on the resulting string later in the code. For example "M0i/%20=3ia5" after urldecode will look like "M0i/ =3ia5".

answered May 15, 2012 at 10:34

Eugene

3,37524 silver badges17 bronze badges

3 Comments

Nick Over a year ago

What if I saved one as a cookie? (I do.) Would that mess it up? What characters should I avoid using?

Eugene Over a year ago

Normally all cookies are urlencoded when sent to browser and urldecoded back in PHP. I don't think that this is an issue.

Eugene Over a year ago

Another thought: Do you use setrawcookie() to set cookie and $_COOKIE array when reading cookies? If yes - you got the bug.

billyonecan · Accepted Answer · 2012-05-16 17:51:23Z

1

You could end up generating html entities. Imagine if your code generated &nbsp or &#160 for example, a space would appear in the string.

edited May 16, 2012 at 17:51

answered May 15, 2012 at 10:43

billyonecan

20.3k9 gold badges44 silver badges66 bronze badges

Comments

SW_Cali · Accepted Answer · 2013-07-03 09:01:02Z

1

Why not just use:

    $length = 12;
    $randomString = substr(str_shuffle("0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"), 0, $length);
    echo $randomString;

answered Jul 3, 2013 at 9:01

SW_Cali

4033 silver badges18 bronze badges

1 Comment

Nick Over a year ago

Interesting. Have you tested which is faster?

Collectives™ on Stack Overflow

PHP random string generator more random than expected

4 Answers 4

4 Comments

3 Comments

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

4 Comments

3 Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related