1
- Securely Generating Random Values
2
- =================================
1
+ Securely Comparing Strings and Generating Random Values
2
+ =======================================================
3
3
4
4
The Symfony Security component comes with a collection of nice utilities
5
5
related to security. These utilities are used by Symfony, but you should
@@ -25,8 +25,7 @@ Generating a Secure Random String
25
25
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
26
26
27
27
Whenever you need to generate a secure random string, you are highly
28
- encouraged to use the
29
- :phpfunction: `random_bytes ` function::
28
+ encouraged to use the :phpfunction: `random_bytes ` function::
30
29
31
30
$random = random_bytes(10);
32
31
@@ -35,26 +34,26 @@ the number bytes passed as an argument (10 in the above example).
35
34
36
35
.. tip ::
37
36
38
- The ``random_bytes() `` function returns a binary string which may contain the
39
- ``\0 `` character. This can cause trouble in several common scenarios, such
40
- as storing this value in a database or including it as part of the URL. The
41
- solution is to encode or hash the value returned by ``random_bytes() `` (to do that, you
42
- can use a simple ``base64_encode() `` PHP function).
37
+ The ``random_bytes() `` function returns a binary string which may contain
38
+ the ``\0 `` character. This can cause trouble in several common scenarios,
39
+ such as storing this value in a database or including it as part of the
40
+ URL. The solution is to encode or hash the value returned by
41
+ ``random_bytes() `` (to do that, you can use a simple ``base64_encode() ``
42
+ PHP function).
43
43
44
44
Generating a Secure Random Number
45
45
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
46
46
47
47
If you need to generate a cryptographically secure random integer, you should
48
- use the
49
- :phpfunction: `random_int ` function::
48
+ use the :phpfunction: `random_int ` function::
50
49
51
50
$random = random_int(1, 10);
52
51
53
52
.. note ::
54
53
55
- PHP 7 and up provide the ``random_bytes() `` and ``random_int() `` functions natively,
56
- for older versions of PHP a polyfill is provided by the ` Symfony Polyfill Component `_
57
- and the `paragonie/random_compat package `_.
54
+ PHP 7 and up provide the ``random_bytes() `` and ``random_int() `` functions
55
+ natively, for older versions of PHP a polyfill is provided by the
56
+ ` Symfony Polyfill Component `_ and the `paragonie/random_compat package `_.
58
57
59
58
.. _`Timing attack` : https://en.wikipedia.org/wiki/Timing_attack
60
59
.. _`Symfony Polyfill Component` : https://github.com/symfony/polyfill
0 commit comments