If we assume that it's good random data (and environment allows using of this openssl PHP function), why don't use it directly instead of rand (limits may be implemented with mod)? I see that now we call seeding every time before we call rand().
Why use machine-depending 'i' option for unpack if we know that length is 4 bytes and know that 'L' is always 4 bytes too?
P.S. also as in PHP "empty" returns true for "", 0 and ever "0", it's bad practice to use it in production in such cases.
It may work but when someone reads $a === '' he knows that you mean that $a may be empty string.
When someone reads empty($a) he don't knows, is $a may be false, '', 0, array() or even '0'.
I'm not sure and don't have enough practice with this function. I do not want to risk so this is "extra" check.
If we assume ... yes, but in this case I prefer two way check. For verification code we need just several digits and rand() is pretty enough for that (and don't slows down). This is not a universal solution, this function is need only in two places.
It does not matter in this case, but okay.
PS again yes, but not matter in this particular case, if openssl in one of 2147483647 cases return 0 I'll be glad to use microtime.
https://github.com/imaginal/nabuvote/blob/master/system/functions.php#L171
P.S. also as in PHP "empty" returns true for "", 0 and ever "0", it's bad practice to use it in production in such cases. It may work but when someone reads $a === '' he knows that you mean that $a may be empty string. When someone reads empty($a) he don't knows, is $a may be false, '', 0, array() or even '0'.