title: Is substr safe for password reset?
body: <p>I was wondering if using <code>substr(md5(rand()), 0, 17);</code> would be safe enough for a password reset link? If I was to generate a longer string would that make it any safer? Is MD5 at all safe? Or should I do <code>$token = sha1(uniqid($username, true));</code>?</p>