Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:109977
To: internals@lists.php.net
References: <9e3b1604-8d0a-9db4-aab6-e5f2198252f4@allenjb.me.uk>
 <C4580849-BC5B-45CA-9B57-56CB63B3F8F0@benramsey.com>
 <CAF+90c-Uc1_F0Yy-kXvspCsLumAbOLfY-G_in3TTE288f=ZTrw@mail.gmail.com>
 <CAJmjfvXUtWE1r9+PxDnRFkbFXgBG=KpRCcfzAyd3N7P3vYB2=w@mail.gmail.com>
Message-ID: <2ce8d735-b1d8-8c09-3b76-8d8176b1344a@gmail.com>
Date: Sun, 3 May 2020 13:57:15 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101
 Thunderbird/68.7.0
MIME-Version: 1.0
In-Reply-To: <CAJmjfvXUtWE1r9+PxDnRFkbFXgBG=KpRCcfzAyd3N7P3vYB2=w@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-GB
Subject: Re: [PHP-DEV] Deprecating uniqid()
From: rowan.collins@gmail.com (Rowan Tommins)

On 03/05/2020 09:54, Jakob Givoni wrote:
> I'm using this function frequently, but I am ok with deprecating it as
> I think the name is dangerously misleading - basically, anything that
> mentions "unique" without saying to what, is a misnomer.
> However, as it's useful to have a function in core that gives you a
> random string with a fixed length that is unique within some
> well-defined boundaries, I'd like to be sure there is an easy
> replacement for the function when the time comes to upgrade php.
> Ideally something that is guaranteed to be unique within the current
> php process and takes the same arguments as uniqid.


I definitely think that all deprecations should come with clear guidance 
of either "use this instead" or "what you're doing is fundamentally wrong".

I'm not sure it needs to retain the same arguments, or even the same 
output format, though, just fit the same use cases. The prefix can be 
added trivially, and the "hex, dot, numeric" output of the "more 
entropy" version is not often particularly helpful.

A common suggestion is to use binhex(random_bytes($desired_length / 2)), 
which isn't particularly elegant, and in my experience, the main 
requirement is "a unique string of printable/alphanumeric characters, so 
limiting to [0-9a-f] is just limiting entropy for no reason.

I wonder if we could add a parameter to random_bytes, or an accompanying 
function, that would return only alphanumeric characters; or perhaps 
accept a range of characters to allow in some form.

Regards,

-- 
Rowan Tommins (né Collins)
[IMSoP]