[PHP] Can this recursive function go crazy?

Question

function generate_session_id( &$db )
{
    $user_sess_id = md5( uniqid( mt_rand(), true );

    try
    {
        $stmt = $db->prepare("SELECT COUNT(*) AS session_exists FROM sessions WHERE session_id = :session_id");
        $stmt->bindParam(':session_id', $user_sess_id);
        $stmt->execute();
        $result = $stmt->fetch( PDO::FETCH_ASSOC );

        if( $result['session_exists'] == 1 )
        {
            // Recursion !
            generate_session_id( $db );
        }      
        else
        {
            return $user_sess_id;
        }
    }
    catch( PDOException $e )
    {
        die( "generate_session_id(): " . $e->getMessage() );
    }
}

Is this function safe to use or are there any flaws in it? Its only purpose is to generate unique ID for each session.

Answer 1

Looks pretty safe. But isn't the point of uniqid that it provides a, er, unique id? And why are you doing an MD5 hash on it? That introduces a whole range of problems...

Answer 2

You're not returning the value of the recursive function, so in case the function is invoked recursively, you'd get no value back. You need to do:

return generate_session_id( $db );

You don't need recursion at all here though. Just do a normal loop:

do {
    // generate id
    $id_exists = // look if id exists
} while ($id_exists);

Also, do you really need to generate the ID yourself? Are you using some session handling that requires this?