Record ID question

[kenle]

Hi all,

Right now, i have a user table. In the user table there is a record_id (user_id) field which is an auto increment field. Every time I insert a new record, this field increment its value by 1.

When I retrieve a user profile, I query it based on this user_id since it is unique.

However, I am still not comfortable with this field has an auto increment. The reason is people can guess all the user_id in the table. They just enter the user_id =1, 2, 3, 4 .... and be able to retrieve all users.

What's the best way to keep track the record_id or user_id field? Anyone out here has a real application that use record_id different than auto_increment by 1 ?

Thanks

[laserlight]

The solution then is security.

Users cannot view info associated with a different user id from their own.

How you implement that depends on how you implement your authentication and access control in the first place.

[udendra]

..yeah for example you could have a different field(ID) with unique values and you could construct that value by using some sort of algorithm in your code ...but make sure that no value appears more than twice in that field.

[udendra]

OOPS..
this : "...but make sure that no value appears more than twice in that field".

It should be more than "once". 🙂

[drawmack]

I use always use the md5 of the auto_increment in urls and session variables, cause the end user can't possibly know what the md5 string translates into and even if they do figure it out the scripts all expect it to come in as md5 and won't work on the number keeps the database clean and gives me some security.

[udendra]

well "drawmack" can you give us an example in using md5 from the point of creating the schema....much appreciated.

thankx.