1

I'm doing a PHP application with CodeIgniter and most of my controllers accept record ids as parameters for retrieving purposes. I also pass record ids in my forms action. Like this: www.sample.com/records/save/sFKu=4

Is this the right way to do this? Note that the record ids are encrypted.

  • You mean to say they are hashed somehow? 001 certainly doesn't look encrypted to me :) – Michael May 17 '13 at 14:44
  • @Michael Oh sorry, that's just a sample. I'm going to edit it. – Gian Acuna May 17 '13 at 14:51
1

If you are concern about record IDs presenting some kind of security risk, then do not use auto-incrementing integers.

I can see a record ID as 2837 then I know there is a 2836, 2835 and so on.

Instead, use UUID as a record identifier. This will ensure each record gets a UUID that is different, and using reading one UUID doesn't give you any information about what other UUID might exist in the system.

There is a Codeigniter UUID project that might help, and some information on what UUIDs are.

  • thanks for posting, appreciate it, had never heard of UUID. – cartalot May 17 '13 at 19:09
1

Yes, thats fine for retreival. Just make sure in your PHP code you are properly validating user rights to the resource, so that people cant edit id's that dont belong to them. You dont want people changing the id's in the URL to be able to access records they arent supposed to be seeing.

For forms or deleting data, you might instead consider placing the id parameter in a hidden input field rather than the URL so they are submitted as POST variables.

1

Right now its standard practice for retrieval BUT i think it should be avoided whenever possible.

Whereas if you have a unique name for the same asset like:
sample.com/products/galactic_telescope

now you have given real meaning to the URL - for humans and for search engines. and you have a flexible system. you can change the ID of that product, you can add variations and accessories, it can go out of stock - and the URL remains the same.

If you are using forms then you can pass the ID in a hidden form field. It also allows you to do other kinds of checks - like you can validate and check the value of that field in your constructor - and if no good - for example the form was filled in by a rogue bot - bounce to a different page or class before any other actions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.