Usually once you register in a website you need to visit a url like:
^random_string^ necessarily need to be cryptographically pseudorandom instead of a time-based random one?
I mean is a necessity to use cryptographically secure randomness such as
openssl_random_pseudo_bytes or a time based one such as:
$string = array_shuffle(explode('','ABCDEFGHIJKLMNOPQRSTUVWXYZ'));
The most common example using the
$length = 10;//Some size. $token = bin2hex(openssl_random_pseudo_bytes($length));