note 69350 deleted from function.uniqid by betz
| From: | betz@php.net | Date: | Sat, 02 Sep 2006 11:48:40 +0000 |
| Subject: | note 69350 deleted from function.uniqid by betz | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-116617@lists.php.net to get a copy of this message | ||
Note Submitter: tom420 dot duhamel at gmail dot com
Reason: useless
----
In answer to admin at code-dynasty dot net:
First, I believe that the odds of collision of MD5 aren't higher than those of the uniqid
itself. In any case, I don't like using session id by itself to identify a user. I like to
check user's IP address ($_SERVER['REMOTE_ADDR']). If by chance session id is
duplicated, I wonder what are the odds of the match appering from the same IP?
There are good points for using MD5 over uniqid. MD5 makes the length of the uniqid predictable,
which is easier depending of the way you use the session id. MD5 hides how you've created the
session id (they can't even tell you've used uniqid), which makes it harder for an
attacker to predict future ids.