I have just started learning PHP and I want to create a website with a login for my final year university project. I've read that blowfish is the best method for hashing in a number of places like here: [openssl\_digest vs hash vs hash\_hmac? Difference between SALT & HMAC?](https://stackoverflow.com/questions/8952807/openssl-digest-vs-hash-vs-hash-hmac-difference-between-salt-hmac/11195855#11195855) 

Everywhere I read about the crypt method includes a string like `$2y$07$usesomesillystringforsalt$` My main question is: how do I randomly generate this? I've read in places that time stamps and mt\_rand() are not secure.

Also I've heard AES is the preferred technology recently but from what I can see it seems pretty tricky to implement in PHP! Is blowfish still an acceptable method to secure stored passwords?