I built a function for generating random pwds of various complexity...
Then have used...
$ukey = generatePassword(16,2).generatePassword(16,2);
for things where I want to pass an id in a url and want it to be difficult to guess. You could probably concatinate a microtime to a random string as well to make it unique and harder to guess. I don't know if this is strong enough for commerce level apps. I use this for more user account management that doesn't have anything like SSN or CCN involved.
// ---- start of function
function generatePassword($length=6,$level=2){
list($usec, $sec) = explode(' ', microtime());
srand((float) $sec + ((float) $usec * 100000));
$validchars[1] = "0123456789abcdfghjkmnpqrstvwxyz";
$validchars[2] = "0123456789abcdfghjkmnpqrstvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
$validchars[3] = "0123456789abcdfghjkmnpqrstvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ~!@#$%&*-+";
$validchars[4] = "0123456789abcdfghjkmnpqrstvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ~!@#$%^&*()_-+=/";
$password = "";
$counter = 0;
while ($counter < $length) {
$actChar = substr($validchars[$level], rand(0, strlen($validchars[$level])-1), 1);
// add current char to pwd string if it's not already in the pwd
if (!strstr($password, $actChar)) {
$password .= $actChar;
$counter++;
}
}
return $password;
}