A random-string function produces many duplicates - php

Question

I am using the function below to generate random strings for filenames. I got no problems on Unix machines but I have many duplicates on Windows. I just made a test and generated 100.000 strings with the result, that each string occurs 227 (??) times. Could anyone explain this? Even with rand() I got duplicates, but srand() seems to work.
function generateRandomString($length = 6)
{
$rows = array();
array_push($rows, range('A', 'Z'));
array_push($rows, range('a', 'z'));
array_push($rows, range(0, 9));
$signs = array();
foreach ($rows as $row) {
$signs = array_merge($signs, $row);
}
shuffle($signs);
shuffle($signs);
$password = '';
for ($i = 0; $i < $length; $i++) {
$password .= $signs[array_rand($signs, 1)];
}
return $password;
}

Answer 1

Well, for one, Windows file names aren't case sensitive, so you should only use either lowercase or uppercase characters in your source arrays, not both.
The rest is basically upto the actual implementation of the PHP processor you're using, rather than Windows vs. *nix. Perhaps they rely on timer resolution and keep no internal state - that would be bad given that usually the timer resolution is about 15ms, which isn't a whole lot. In any case, it's most likely an issue with the PHP implementation, not Windows itself, as this code in C# nicely illustrates:
Random rnd = new Random();
byte[] buf = new byte[10 * 100000];
rnd.NextBytes(buf);
buf
.Select((val, idx) => new { Index = idx, Value = val })
.ToLookup(i => i.Index / 10)
.Select(i => string.Join(string.Empty,
i.Select(j => j.Value.ToString("X2")).ToArray()))
.GroupBy(i => i)
.Where(i => i.Count() > 1)
.Dump();
This creates 100 000 random strings of 20 characters (0 to F) and looks for duplicates. In a few hundred tests, I haven't had a single collision. So if you've got trouble with the random generator in PHP, go look at the particular implementation of PHP you're using, rather than blaming Windows :)
It's interesting how your code does a few passes of the randomness (shuffling the $signs array twice and then picking randomly from that?). Doing this most likely reduces the randomness of the data rather than increasing it. Seems just like a stupid attempt at hiding the password generation mechanism behind layers of obscurity (and then open sourcing it... eh :D).
As for passwords (your code seems to indicate that's what it was used for), you should probably use the crypto-secure randoms anyway - they're far less predictable, more random and less prone to bias.