If you want to use these strings for security purpose, you should use openssl_random_pseudo_bytes which will indicate you if PHP was able to use a strong algorithm to generate it:
Ouput needs some cleaning though. Have a look at this question for more info.