How to get unique short strings from integers?

Question

Say, I have a customers with a integer PK. In my web apps I want to have a profile page for them. I do not want a url like /profile/10375/ (For example, I do not want others to know how many customers I have). I also do not want a slug base url like, /profile/acme_corp/.

What is a good way to convert unique integers to unique random short strings? (For example, earlier Reddit used to have this type of urls, but it was a conversion from decimal to base 36, skipping some ids). But that too is not useful for me as it si easy to guess number of entities in DB with this scheme.

I cant use UUID etc, as they would make the url too large.

Answer 1

You could always base64 then url encode the id's.

in php:

urlencode (base64_encode("1234"))
> MTIzNA%3D%3D

base64_decode(urldecode("MTIzNA%3D%3D"))
> 1234

Answer 2

If the primary concern is that one customer can look at another customer's page I wouldn't depend on the method you are proposing. Ultimately it is "Security Through Obscurity". I would, instead, tie the display of the page to the customer's authentication credentials (providing you require your users to log in). If the customer tries to access a profile page other than their own they redirected to the login page or given an access authorization error message.

In fact you don't even need to have the customerID in the URL. Just use /profile/

Answer 3

maybe you could asociate a random pair of letters of the alphabet to each digit...

Answer 4

The easiest and safest way to do this would be to create lookup table with a mapping from the customer id to a unique random string.

Answer 5

There are some hash algorithms which produce short (8 characters, 0-9a-f) output strings, for example adler32 or crc32. You can generate them using PHP function hash() (see hash_algos() for a list of available algorithms), but I’m not sure your DB engine itself can handle it. If that’s the case, generating random slugs would be a better solution.

And add salt when hashing, so it’s more secure.