Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:109972
To: PHP Internals <internals@lists.php.net>
Message-ID: <9e3b1604-8d0a-9db4-aab6-e5f2198252f4@allenjb.me.uk>
Date: Sat, 2 May 2020 19:57:32 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101
 Thunderbird/68.7.0
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-GB
Subject: Deprecating uniqid()
From: php.lists@allenjb.me.uk (AllenJB)

Hi all,

I'd like to discuss deprecating uniqid()

I believe it's dangerously bad a doing "what it says on the tin". New 
developers still reach for it and do not read the warnings on the manual 
page (or if they do, don't fully understand how bad it is).

For older codebases that still rely on it, a userland replacement can be 
easily implemented (and could be published on Packagist).

I noticed there was an RFC [0][1] brought up 2 years ago, but was never 
voted on. Does anyone know why this was?

[0] https://externals.io/message/102097
[1] https://wiki.php.net/rfc/deprecate-uniqid

Is there interest in deprecating this function?

If not deprecation, how could it be (further) "improved"? My first 
thought is to make the "more entropy" option enabled by default (the 
argument could remain so that it can be disabled by codebases that rely 
on the lower length and can take the tradeoffs).

AllenJB