Removing ambiguous characters is the same as never including them

generate_passwords.php

<?php
$LENGTH = 4;
$SAMPLES = 100000;
$all = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
$ambig = ["l","1","I","o","O","0"];
$unambig = str_replace($ambig, "", $all);

function generate_passwords($remove, $set, $length, $samples) {
        global $ambig;
        $numbers_yes = 0;
        $numbers_no = 0;
        for ($a = 0; $a < $samples; $a++) {
                $password = "";
                for ($c = 1; $c <= $length * 2; $c++)
                        $password .= $set[random_int(0, strlen($set)-1)];
                if ($remove)
                        $password = str_replace($ambig, "", $password);
                $password = substr($password, 0, $length);
//              echo $password, "\n";
                if (strpbrk($password, "0123456789") == TRUE)
                        $numbers_yes++;
                else
                        $numbers_no++;
        }
        return $numbers_no / ($numbers_yes + $numbers_no);
}
echo "No numbers when ambiguous characters never included:\t", generate_passwords(FALSE, $unambig, 4, 10000), "\n";
echo "No numbers when ambiguous characters removed:\t", generate_passwords(TRUE, $all, 4, 10000), "\n";
?>