note 91126 added to function.uniqid

Generating an MD5 from a unique ID is naive and reduces much of the value of unique IDs, as well as providing significant (attackable) stricture on the MD5 domain. That's a deeply broken thing to do. The correct approach is to use the unique ID on its own; it's already geared for non-collision. IDs should never be obfuscated for security, so if you're worried about someone guessing your ID, fix the system, don't just make it harder to guess (because it's nowhere near as difficult to guess as you imagine: you can just brute force the 60,000 MD5s that are generatable from millisecond IDs over the course of a given minute, which the typical computer can do in less than 0.1s). If you absolutely need to involve a hash somehow - maybe to placate a boss who thinks they understand security much better than they actually do - append it instead. function BadIdeaID() { return uniqid() . '_' . md5(mt_rand()); } ---- Server IP: 209.41.74.194 Probable Submitter: 24.117.110.56 ---- Manual Page -- http://www.php.net/manual/en/function.uniqid.php Edit -- https://master.php.net/note/edit/91126 Del: integrated -- https://master.php.net/note/delete/91126/integrated Del: useless -- https://master.php.net/note/delete/91126/useless Del: bad code -- https://master.php.net/note/delete/91126/bad+code Del: spam -- https://master.php.net/note/delete/91126/spam Del: non-english -- https://master.php.net/note/delete/91126/non-english Del: in docs -- https://master.php.net/note/delete/91126/in+docs Del: other reasons-- https://master.php.net/note/delete/91126 Reject -- https://master.php.net/note/reject/91126 Search -- https://master.php.net/manage/user-notes.php