include::../description.adoc[]

As the ``++rand()++`` and ``++mt_rand()++`` functions are no CSPRNGs, they should not be used for security-critical applications or for protecting sensitive data.

include::../ask-yourself.adoc[]

== Recommended Secure Coding Practices

* Use functions which rely on a cryptographically secure pseudo random number generator (CSPRNG) such as ``++random_int()++`` or ``++random_bytes()++`` or ``++openssl_random_pseudo_bytes()++``.
* When using ``++openssl_random_pseudo_bytes()++``, provide and check the ``++crypto_strong++`` parameter.
* Use the generated random values only once.
* You should not expose the generated random value. If you have to store it, make sure that the database or file is secure.

== Sensitive Code Example

----
$random = rand(); // Sensitive
$random2 = mt_rand(0, 99); // Sensitive
----

== Compliant Solution

[source,php]
----
$randomInt = random_int(0,99);
----

include::../see.adoc[]

ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

include::../message.adoc[]

'''
== Comments And Links
(visible only on this page)

=== on 23 Jul 2018, 16:13:39 Tibor Blenessy wrote:
I will also add \http://php.net/manual/en/function.mt-rand.php function

=== on 24 Jul 2018, 10:32:31 Andrei Epure wrote:
``++openssl_random_pseudo_bytes++`` has a reference parameter (http://php.net/manual/en/function.openssl-random-pseudo-bytes.php[crypto_strong]) to check if the generated number is cryptographically strong (depending on the OS underneath).


Ideally, it should be passed and checked, right?

=== on 26 Jul 2018, 09:51:36 Alexandre Gigleux wrote:
\[~andrei.epure] I adjusted the RSPEC. No need to change the rule's implementation for ``++openssl_random_pseudo_bytes++``

include::../comments-and-links.adoc[]

endif::env-github,rspecator-view[]
