PHP comes with two proper functions for this usage: random_int() and random_bytes().

Other functions like rand() are a footgun and should be avoided.

The only situation where you could have a valid usage of them is when you need a seeded RNG but even in this situation using something in the spirit of https://github.com/paragonie/seedspring would be a better call.