Complex Random Password Generator

Nice, @ApocDen — the function is a straightforward way to request a fixed length and a set number of digits. A few practical fixes will make it safer and more predictable for real use.

The main issues to address:

• The digit set in the snippet omits 0, so 0 will never appear.
• There’s no input validation: negative values or $nums > $length should be handled.
• rand()/mt_rand() (and str_shuffle) are not suitable for generating credentials; use a cryptographically secure generator.
• The per-character conditional logic makes placement harder to reason about. A clearer pattern is: build exactly the required digits and letters, then perform a secure shuffle to mix them uniformly.

A concise, safer approach (PHP 7+ using random_int) — generate the exact counts, then do a Fisher–Yates shuffle:

function securePassGen($length, $nums) {
    $length = (int)$length;
    $nums = max(0, (int)$nums);
    if ($length <= 0) return '';
    if ($nums > $length) $nums = $length;

    $digits = str_split('0123456789');
    $lower  = str_split('abcdefghijklmnopqrstuvwxyz');
    $upper  = str_split('ABCDEFGHIJKLMNOPQRSTUVWXYZ');

    $chars = [];
    for ($i = 0; $i < $nums; $i++) {
        $chars[] = $digits[random_int(0, count($digits) - 1)];
    }
    for ($i = 0, $letters = $length - $nums; $i < $letters; $i++) {
        $pool = (random_int(0,1) === 0) ? $lower : $upper;
        $chars[] = $pool[random_int(0, count($pool) - 1)];
    }

    for ($i = count($chars) - 1; $i > 0; $i--) {
        $j = random_int(0, $i);
        $tmp = $chars[$i]; $chars[$i] = $chars[$j]; $chars[$j] = $tmp;
    }

    return implode('', $chars);
}

Notes: random_int requires PHP 7+ (use a vetted polyfill or openssl_random_pseudo_bytes on older installs). Consider adding symbols only if target systems accept them. Never log generated passwords; if they’re for authentication, store only secure hashes (e.g., password_hash) and prefer users choose/passphrases or managed random passwords via password managers.