Home » Text » Text_Password » Bug #2090

[2004-08-09 08:27 UTC] alex at rinass dot net

Description:
------------
I think the function _createUnpronounceable could be done more efficient. Orignial code:

do {
$chr = chr(mt_rand(0, 255));
if (preg_match('/'.$regex.'/US', $chr)) {
$password .= $chr;
}
} while (strlen($password) < $length);

Why create a random char from complete ascii set and then run an expensive preg_match on it? If you use only like 10 chars (e.g. numerics) then the chance to hit 10 out of 255 takes a unnecessary long time to create a password.

Can't it be done easier this way? :

for($i=0;$i<$length;$i++) {
$num = mt_rand(0,strlen($chars)-1);
$pwd .= substr($chars,$num,1);
}

This way I pick a random number between 0 and the number of chars and then pick the char at that position. The $chars variable has to contain only the chars then of course.

Also, I didn't read the function params closely and passed a custom char string without commas. The regex wasn't build correctly and I got into an endless loop, need to restart apache:

createPassword(12,'unpronounceable','abcdef[...]');

Maybe there should be a check to handle this.

[2004-08-27 07:49 UTC] alex at rinass dot net

I tested the function with different parameters and it worked perfectly.

Thanks for implementing it!

Hmm, am i supposed to close this bug now?