Re: [RFC] Make uniqid() more unique
| From: | Yasuo Ohgaki | Date: | Fri, 09 Sep 2016 11:48:46 +0000 |
| Subject: | Re: [RFC] Make uniqid() more unique | ||
| References: | 1 2 3 4 5 6 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-95852@lists.php.net to get a copy of this message | ||
Hi all,
On Fri, Sep 9, 2016 at 8:18 PM, Arvids Godjuks <arvids.godjuks@gmail.com> wrote:
>
> Hm, without "true" you get 13 chars, with "true" - 20+.
Sorry. It's
$ php -r 'var_dump(uniqid(), uniqid("", true));'
string(13) "57d29c20c04c3"
string(23) "57d29c20c04c50.55225401"
I misread sprintf format.
Anyway, we may use extra 10 chars to make it more random if it should
keep compatibility. It seems uniqid() is popular for test scripts, so
it would be preferred keeping it. It does not harm any with test
script thanks to higher precision timers of current systems.
Some of us feel returning almost random value from uniqid() is
overkill. This is reasonable. I'll prepare patch that uses 10 chars
for 50 bits extra entropy from php_random_bytes() by default. It will
be a little safer even when user misuses uniqid() while keeping
most compatibility.
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net