That's the more sound advice.

Also, random_bytes() > openssl_random_pseudo_bytes() :P

Though if you use random_compat[1] it might be the same function ;)

[1]: https://github.com/paragonie/random_compat