You can't use a "random" salt (such as one generated from the rand function) because then you can't calculate the hash later to verify they entered the correct password, unless of course you store that "random" salt in the database, which would defeat the purpose if your database is compromised.

Typically hash's are calculated using something like: $hash = sha1($password."secretcode".$username); - none of which are random.

If you were to add a random number into that like this: $rand = rand(1,99); $hash = sha1($password.$rand);

Now you can't do if($hash1 = $hash2) { loginSuccess(); } because you will never know what random salt was generated for the original hash.