title: Generating cryptographically secure tokens
body: <p>In order to generate a 32 character token for access to our API we currently use:</p>
  
  <pre><code>$token = md5(uniqid(mt_rand(), true));
  </code></pre>
  
  <p>I have read that this method is not cryptographically secure as it's based on the system clock, and that <code>openssl_random_pseudo_bytes</code> would be a better solution as it would be harder to predict.</p>
  
  <p>If this is the case, what would the equivalent code look like?</p>
  
  <p>I presume something like this, but I don't know if this is right...</p>
  
  <pre><code>$token = md5(openssl_random_pseudo_bytes(32));
  </code></pre>
  
  <p>Also what length makes sense that I should pass to the function?</p>