title: md5(uniqid) makes sense for random unique tokens?
body: <p>I want to create a token generator that generates tokens that cannot be guessed by the user and that are still unique (to be used for password resets and confirmation codes).</p>
  
  <p>I often see this code; does it make sense?</p>
  
  <pre><code>md5(uniqid(rand(), true));
  </code></pre>
  
  <p>According to a <a href="http://nl2.php.net/manual/en/function.uniqid.php#95001" rel="noreferrer">comment</a> <code>uniqid($prefix, $moreEntopy = true)</code> yields</p>
  
  <blockquote>
    <p>first 8 hex chars = Unixtime, last 5 hex chars = microseconds.</p>
  </blockquote>
  
  <p>I don't know how the <code>$prefix</code>-parameter is handled..</p>
  
  <p>So if you don't set the $moreEntopy flag to true, it gives a predictable outcome.</p>
  
  <hr>
  
  <p><strong>QUESTION:</strong> <em>But if we use <code>uniqid</code> with <code>$moreEntopy</code>, what does hashing it with md5 buy us? Is it better than:</em></p>
  
  <pre><code>md5(mt_rand())
  </code></pre>
  
  <p><strong>edit1:</strong> I will store this token in an database column with a unique index, so I will detect columns. Might be of interest/</p>