I am using some "magic link" one-time passcodes for automatically logging users in for a specific purpose on our website.
My plan is to generate a hash based on the datetime, users specific "ID" and a random int.
Then take this hash and use it a prefix to uniqid as per:
$hash = sha1(date("Y-m-d H:i:s") . $memberId . random_int(0, 9999) ); $OTP = uniqid($hash, true);
After a bit of thinking I guess the use of uniqid is pretty redundant, but would it actually make it less secure to do it this way?