Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:95972
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain ohgaki.net designates 180.42.98.130 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <87mvjcbfcb.fsf@lil.giraffy.jp>
References: <CAGa2bXYg1kkoYGQNr8T2oTshuqrvweefYO+EdY41w1vwUM32iQ@mail.gmail.com>
 <878tuxenl4.fsf@lil.giraffy.jp> <CAGa2bXaTydTSZniX4dUA9h_FcNaymyqfDXQJO0zx1ZDfLmvWdg@mail.gmail.com>
 <87twdlcs2j.fsf@lil.giraffy.jp> <CAGa2bXaziNMtNAgsJgX-BCgLL9z2WkoSaP8aNVrAgwo9MJ4WEQ@mail.gmail.com>
 <87h99lch13.fsf@lil.giraffy.jp> <CAGa2bXYeWZSx2vOYPhnCJ_O7ry2jPNNPcm=mpNuVJAwYAY5sMA@mail.gmail.com>
 <877fagczci.fsf@lil.giraffy.jp> <CAGa2bXZPrarOmRvYiDVar3qw1bUyHXsnMYRsgkPbvwXHO8BLuw@mail.gmail.com>
 <CAGa2bXYJ2=Tn20zy2BkXJCgAxuEq08Bv7ZA85GtYPZND3dTK2g@mail.gmail.com> <87mvjcbfcb.fsf@lil.giraffy.jp>
Date: Tue, 13 Sep 2016 14:45:35 +0900
Message-ID: <CAGa2bXa-nSDgJfyaGWLFkG3m637Q7S=G5NWO2Wu7eLJqLe3Zgg@mail.gmail.com>
To: Kazuo Oishi <kazuo@o-ishi.jp>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Improve uniqid() uniqueness
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Kazuo,

On Tue, Sep 13, 2016 at 1:20 PM, Kazuo Oishi <kazuo@o-ishi.jp> wrote:
> The uniqid() manual explicitly say,
>
>  - default value of more_entropy is false
>
>  - the returned string will be 13 characters long. If more_entropy is
>    TRUE, it will be 23 characters.
>
>  - if more_entropy is set to TRUE, uniqid() will add additional entropy
>    (using the combined linear congruential generator) at the end of the
>    return value
>
> http://php.net/manual/en/function.uniqid.php
>
> So, it is fairly valid to design
>  - field length limit to 13 chars in validation code or DB column.
>  - acceptable character type limit to "[0-9A-Za-z]+".
>  - expect increasing value
> in their PHP applications.

It's legacy design.

php_combined_lcg() must not be used, especially functions like
uniqid(). i.e. It's supposed to generate unique ID based on time, but
php_combined_lcg() generates pseudo random from current time.

It's more than obvious it's legacy and obsolete today.

>> Anyway, let's talk BC with real code.
>>
>> I didn't look into all, but only briefly.
>> https://searchcode.com/?q=uniqid&loc=0&loc2=10000&lan=24
>
> Why didn't you...
> You said "BC (BC break) will be minimum"...

Why should I look into all?
Show me the real code that breaks if you insist this minor BC matters.

I can think of number of way to be broken, but I cannot imagine real
production codes that are broken by change.

BTW, the current manual states uniqid() return unique identifier.
This is false.

I updated the manual, but we should do better job to generate almost unique ID.

  <refsect1 role="returnvalues">
   &reftitle.returnvalues;
   <para>
-   Returns the unique identifier, as a string.
+   Returns timestamp based unique identifier as a string.
   </para>
+  <warning>
+   <para>
+     This function tries to create unique identifier, but it does not
+     guarantee 100% uniqueness of return value.
+   </para>
+  </warning>
  </refsect1>

Current implementation is good enough for most cases, but it can be better.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net