note 25076 deleted from function.getmypid by danbrown
| From: | danbrown@php.net | Date: | Sun, 20 Jul 2008 00:27:48 +0000 |
| Subject: | note 25076 deleted from function.getmypid by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-141846@lists.php.net to get a copy of this message | ||
Note Submitter:
----
Something you can use to combine several weak entropy sources, into a better init value for srand()
and mt_srand():
mt_srand(time()
^ (int)microtime()
^ ip2long($_SERVER['REMOTE_ADDR'])
^ (int)$_SERVER['REMOTE_PORT']
^ @getmypid()
^ @disk_free_space('/tmp')
);
Note that getmypid() may return 0 on some shared PHP installations that have excluded it for
"safe"...
The safe mode also exclude the disk_free_space(directory) function call in some cases, for security
reason. This explains the use of the @ operator to ignore warnings... the directory should be a
highly active directory, which is accessible and typically used for temporary contents generated by
PHP.
The above code combines all these sources using XOR binary operations, to avoid 32-bit overflows.