How to grab lottery ball naturally - php

Question

<?php
class Lottery
{
private $start;
private $end;
public function __construct($start = 1, $end = 49)
{
$this->start = $start;
$this->end = $end;
}
public function balls($num = 5)
{
$balls = range($this->start, $this->end);
shuffle($balls);
$index = array_rand($balls, $num);
$result = [];
for ($i = 0; $i < $num; ++$i) {
$result[] = $balls[$index[$i]];
}
$result = implode(', ', $result);
return $result;
}
}
This is how I get my lottery ball, my friend told me with more and more game goes, there will be some rule to follow if you random by built-in function, is that true? and how to prevent that.
updated code
<?php
class Lottery
{
private $start;
private $end;
public $tempBalls = [];
public function __construct($start = 1, $end = 49)
{
$this->start = $start;
$this->end = $end;
}
public function balls($num = 5)
{
$balls = range($this->start, $this->end);
$results = [];
do {
$results[] = $this->randBall($balls);
} while (count($results) < $num);
$result = implode(', ', $results);
$this->tempBalls = [];
return $result;
}
private function randBall($range)
{
$ball = $range[mt_rand(0, count($range) - 1)];
if (!in_array($ball, $this->tempBalls)) {
$this->tempBalls[] = $ball;
} else {
return $this->randBall($range);
}
return $ball;
}
}

Answer 1

I've not tested with shuffle() but certainly the rand() function will always return the same sequence of numbers unless you first set a seed value. Checking if this applies to shuffle() should be trivial.
If you read the documentation, you'll see that rand() returns a pseudo random number and contains warnings about not using it for encryption. If you consider a simpler case, where rand always returns a digit from the set {0,1,2,3,4,5} then wraps around, just starting at random offset then it should be obvious that this undermines the point of the encryption, indeed changing the order of numbers in the initial set does not really impact this much.
But how much of this actually applies to lottery balls? Firstly, nobody with any knowledge of encryption would use such a small range to generate a random number in such a range. Secondly, you are not trying to protect the secrecy of data.
The random numbers you use for selecting numbers to put on a ticket does not influence the outcome.
The random numbers you pick for encryption does influence the outcome.
There may be other considerations about fairness. You don't say if you're picking values as a lottery customer or if you are picking the winning numbers. The latter implies that you must be able to prove there is not an intrinsic flaw in your code. I've said that rand() returns a predictable set of numbers, but its output when seeded requires a very large set of numbers to be known (the pattern repeats after 2^31 in the case of rand()), or the seed value to be known in order for the values to predicted.
By all means, use mt_rand() or openssl_random_pseudo_bytes() but it won't make any functional difference to your project.