An update for those that find this question since it ranks highly on Google.
If appears from the current PHP documentation that openssl_random_pseudo_bytes can generate a cryptographically strong string, but this is system dependent. You need to pass in a second parameter then check the response like so:
openssl_random_pseudo_bytes( 32, $cstrong );
if ( !$cstrong ) echo 'weak!';
If $cstrong is false the string is not cryptographically strong.
If you're using PHP 7+ you should use random_bytes instead.
Personally I generate tokens as follows:
$token = bin2hex( random_bytes(32) );
This generates a 256 bit string, which is a bit of future proofing.