random_bytes and random_int are finally in core

Generating a secure token used to mean openssl_random_pseudo_bytes() with its easily-ignored $strong out-parameter, or mcrypt_create_iv(), or a userland library working out which of those existed. PHP 7 put a CSPRNG in core with no configuration.

$token = bin2hex(random_bytes(32));

$dice = random_int(1, 6);   // uniform, not modulo-biased

Both throw rather than degrade: if the system has no usable entropy source you get an Error, not a weaker number, which is the correct failure mode for something whose only job is unpredictability. random_int() also removes the modulo bias that rand() % $n introduces — small enough to ignore for a dice roll, not for a password reset token.