downgrade random_bytes() for PHP 5.6

[mambax7]

See: XOOPS/xmf#106

[ggoffy]

why
xoopsGetElementById('antispam_md5').value = '$secureToken';
and not
xoopsGetElementById('antispam_md5').value = $secureToken;

[mambax7]

Using quotation marks ensures that the code is treated as a single string literal, preventing unintended concatenation. This allows the $secureToken variable's value to be properly inserted into the string, resulting in valid JavaScript code that can be executed.

1. With Single Quotes ('$secureToken'): This method ensures that the value of $secureToken is treated as a string in JavaScript. When PHP processes this code, it replaces $secureToken with its value, and the single quotes are retained in the output JavaScript code. This is important if $secureToken is expected to be a string, which is often the case for tokens.

2. Without Quotes ($secureToken): If you omit the quotes, PHP will still replace $secureToken with its value, but there will be no quotes around this value in the resulting JavaScript code. This can lead to issues if the token is a string that contains characters which could be interpreted as code, potentially causing syntax errors or unintended behavior in JavaScript.

In the context of a token, which is typically a string of alphanumeric characters, you would want to use single quotes to ensure that it is correctly interpreted as a string literal in JavaScript. Not using quotes could potentially lead to JavaScript errors if the token contains characters that JavaScript interprets in a different way (like spaces, or characters like {, }, [, ], etc.).

So, the recommended approach is:

$js_in_validate_function = "
    xoopsGetElementById('antispam_md5').value = '$secureToken';

This ensures that the token is safely and correctly embedded as a string in the JavaScript code.

[geekwright]

No longer needed.