title: creating random salt with php's crypt
body: <p>Usally we use <code>mt_rand</code> to create a random salt to use it with <code>crypt()</code>. 
  But according to <code>mt_rand</code> manual page on php's site "not be used for cryptographic purposes[...]consider using openssl_random_pseudo_bytes() instead." Also, at <code>crypt</code> manual page on php's site, someone suggest to use the </p>
  
  <pre><code>mcrypt_create_iv
  </code></pre>
  
  <p>So, to test them, I took <a href="http://www.php.net/manual/en/function.crypt.php#105949" rel="nofollow">this</a> crypt's wrapper and change the following line</p>
  
  <pre><code>$salt .= substr("./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", mt_rand(0, 63), 1);
  
  //change it to
  $salt .= substr("./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", openssl_random_pseudo_bytes(63, $cstrong), 50); 
  
  $salt .= substr("./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", mcrypt_create_iv(63, MCRYPT_RAND), 50); 
  
  $salt .= substr("./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", mt_srand(), 1);
  </code></pre>
  
  <p>Then I commented all the lines except one and start running the code, to check each function. I refreshed my page and the validation works fine. But when I run <code>openssl_random_pseudo_bytes</code> or <code>mcrypt_create_iv</code> I see the same hash frequently. </p>
  
  <pre><code>$2y$08$$$$$$$$$$$$$$$$$$$$$$.UrC6Lo4LNk8iLmoi25KEoVzHHTK7tNC
  </code></pre>
  
  <p>I saw the above hash like 10 times.</p>
  
  <p>When I use  <code>mt_srand</code> the hash never changes at all.</p>
  
  <p>I test the same functions in another, simpler wrapper, found <a href="http://www.the-art-of-web.com/php/blowfish-crypt/#section_2" rel="nofollow">here</a> and they act the same as I described above.</p>
  
  <p>I am a begginer with hashing and <code>crypt</code>. I'm confused, what should I actually use? </p>