Re: generate 2 random numbers in rapid sequence



I need to generate 2 random numbers in rapid sequence from either PHP or
mysql.

Same page hit or different page hits? I cannot explain why you
would get the same number in rapid sequence from several calls on
the same hit.


same page hit on the webserver to a .html file, which has 2 <img
src=img.php> elements.
on a multiprocessor webserver, this may be occurring simultaneously.

Show the code for generating the two <img src= tags. Since PHP is
a procedural and uni-tasking (within any page, unless you start
calling fork()) language, these should NOT be done simultaneously,
even on a multi-processor system, although they might be done fast
enough that microtime() doesn't advance. Also show all the calls to get
random numbers and set seeds.

Are you sure you're not seeding twice with the same seed? SEED ONLY ONCE.

Look at the source HTML code. Are you getting:

- the same image number (e.g. 1) all the time?
- random first image number but the second is always the same as the first?

Things to use for a seed (jumble them all together, as in concatenate,
then take md5 of result, then convert some of md5 result to integer):
microtime()
getmypid()

believe it or not, on these 2 I get the same pictures. frustrating.

Are you running Apache 2.0? It may be using threads instead of
processes, even for PHP. Is PHP even supposed to work with Apache
2.0 yet? On a multiprocessor system?

$_SERVER['UNIQUE_ID'] (Apache only, and may need a module turned on)

Don't think I have that option. sure sounds good though.

The module name is mod_unique_id.


$_SERVER['REMOTE_ADDR']
$_SERVER['REMOTE_PORT']

these two won't make it unique, because both images are going to be all on
the same page.
mt_srand(make_seed()+getmypid()+$_SERVER['UNIQUE_ID']);
$n=mt_rand(1,$row['a']);

Show me the code to generate the SECOND id. You don't repeat both
of those lines of code, do you? SEED ONLY ONCE!

tried this, but still doesn't do it. I don't even get an error on
$_SERVER['UNIQUE_ID']. I think it's NULL. is $_SERVER['UNIQUE_ID'] a
string I should hash, or an integer?

It's a string. Try printing it just to see if it's getting set at all.
If it is getting set, it's probably being interpreted as the integer 0
because you're trying to use it as a number.

Please verify your code:

1) There is at most one call to microtime() in any of the files used
by this page. This call is NOT inside a function. More specifically,
this call is NOT inside make_seed(). Delete that function and
expand it in line (ONCE) if desired.
2) There is at most one call to any function to set a seed (srand,
mt_srand). This call is NOT inside a function.

Gordon L. Burditt
.



Relevant Pages

  • Re: generate 2 random numbers in rapid sequence
    ... Same page hit or different page hits? ... enough that microtime() doesn't advance. ... random numbers and set seeds. ... IE requests/loads images in series-parallel very rapidly. ...
    (comp.lang.php)
  • [UNIX] PHP GENERATE_SEED() Weak Random Number Seed Vulnerability
    ... Get your security news from a reliable source. ... Weak random number seed might lead to security problems in PHP ... Since version 4.2.0 PHP automatically seeds the random number generators ... in a zero, because then the seed will be zero, too. ...
    (Securiteam)
  • [Full-disclosure] Advisory SE-2008-02: PHP GENERATE_SEED() Weak Random Number Seed Vulne
    ... PHP GENERATE_SEEDWeak Random Number Seed Vulnerability ... Since version 4.2.0 PHP automatically seeds the random number ... depends on the current microsecond and the process identifier. ... will result in a zero, because then the seed will be zero, too. ...
    (Full-Disclosure)
  • Advisory SE-2008-02: PHP GENERATE_SEED() Weak Random Number Seed Vulnerability
    ... PHP GENERATE_SEEDWeak Random Number Seed Vulnerability ... Since version 4.2.0 PHP automatically seeds the random number ... depends on the current microsecond and the process identifier. ... will result in a zero, because then the seed will be zero, too. ...
    (Bugtraq)
  • Re: Random generator
    ... >> function in PHP uses the C rand function, which may differ from C library ... using an algorithm like the one I posted above. ... >produce a predictable sequence from known seeds, but seed it from timeand ... from either Java or PHP. ...
    (comp.lang.php)