The way you generate random string is not safe. You should rely on PHP Internal/openssl
See how I revisited you code:
https://github.com/bbalet/phpback/blob/e9b2415f1d845cb607b156e65f236a5f4f359dd4/install/install1.php#L130