Use openssl_random_pseudo_bytes() if possible.