[Mithaldu]

Sans per-call profiling i'd expect the string concatenation time to be dwarved by the calls to rand.

Edit: Does PHP even have any per-call profilers?

[magnetikonline]

For sure - it totally dwarves it. I'm not so worried about the time value itself, just which method is "faster".