The documentation says that crypto_strong is set depending on the algorithm used. So it will never go from false to true, so yes, this might result in an infinite loop.
Use it instead to see if you should trust the result. If it is true, the string should be secureshould be secure.
(you should also never design your own crypto algorithms for anything other than academic interest)
because this is codereview, I also have a couple of notes regarding your code:
- Why do you divide the length by 2? Seems unnecessary. If it does have a purpose, comment on it.
falseTRUE: use case uniformly. eitherfalseandtrueorFALSETRUE$hex = bin2hex($bytes); return $hex;just make this one line:return bin2hex($bytes)- it is convention to use camelCase for variables, so
Lengthshould belengthand the function namegenerateRandomString