src/Controller/GameController.php

@@ -112,11 +112,10 @@ class GameController implements ISecured
     public function createNewChallenge(): IContent
     {
         // create Challenge
-        $challengeToken = rand();
-        while ($this->challengeRepository->getByToken($challengeToken)) {
-            // if a challenge with the same token already exists
-            $challengeToken = rand();
-        }
+        do {
+            // initiliaze or if a challenge with the same token already exists
+            $challengeToken = mt_rand();
+        } while ($this->challengeRepository->getByToken($challengeToken));
 
         $challenge = new Challenge();
         $challenge->setToken($challengeToken);

src/Repository/UserInChallengeRepository.php

@@ -57,11 +57,9 @@ class UserInChallengeRepository
         }
 
         // validate token string
-        foreach (str_split($token_str) as $char) {
-            if (!(('0' <= $char && $char <= '9') || ('a' <= $char && $char <= 'f'))) {
+        if (!ctype_xdigit($token_str)) {
             return null;
         }
-        }
         // convert token to int
         $token = hexdec($token_str);