Generating random and secure CSRF tokens
If CSRF stands for Cross Site Request Forgery, then it's hard to imagine why I should help.  

In any case, simply doing a cryptographic Whirlpool hash of a user-supplied string with a random seed value should be sufficiently random for most every purpose.  The rest is just obfuscation and doesn't add to security.