0

Currently I have a mysql table that displays information about job opportunities. I have an auto incrementing primary key and I want to encode so it isn't easily recognizable.

So the key "1" would be converted into something short like "AE93DZ". So for URL purposes it isn't something like somesite.com/view/1

Primary Key Unique Id   |   Job Name
1                       | Gardening at X
2                       | Dishwasher at Y
3                       | Etc
4                       | Etc

The primary key needs to be able to be decoded back into it's original key so I can search the database, eg if the user were to click the post then it needs to pull up that job post.

I have tried using Base64 encoding the key.

public static function encode( $input )
{
    $salt= "example_salt";
    $encrypted_id = base64_encode($input . $salt);;
    return $encrypted_id;
}

public static function decode( $raw )
{
    $salt = "example_salt";
    $decrypted_id_raw = base64_decode($raw);
    $decrypted_id = preg_replace(sprintf('/%s/', $salt), '', $decrypted_id_raw);
    return $decrypted_id;
}

The encryption returns something like

OE1ZX1SKJS3KSJNMg==

which is too long and contains "=" signs.

10
  • 4
    It would be nice to know why you don't want the key to be easily recognizable. Aug 16, 2019 at 18:03
  • 1
    Can you not simply add another field with the UNIQUE attribute that's a base64 OF the id? That way you have your ID for searching the db -- AND you have the unique obfuscated key (probably for URL purposes?)
    – Zak
    Aug 16, 2019 at 18:03
  • 3
    Please don't call this encryption - it isn't. Aug 16, 2019 at 18:08
  • 1
    @user2515606 -- Like $string = substr($string, 0, 8); ?
    – Zak
    Aug 16, 2019 at 18:11
  • 1
    add a UUID? mysqltutorial.org/mysql-uuid
    – xQbert
    Aug 16, 2019 at 19:35

2 Answers 2

4

I though that changing the base of the ID and add a offset could give you a nice short way to obfuscate the id. Something like this:

function obfuscate($number)
{
    $offset = 12345678;
    return strtoupper(base_convert($number + $offset, 10, 36));
}

function deobfuscate($code)
{
    $offset = 12345678;
    return base_convert($code, 36, 10) - $offset;
}

Here 1 would become 7CLZJ and 9999 would become 7CTP9. The codes are guaranteed to be unique. By converting to base 36 the code would only contain the number 0...9 and the letters A....Z.

Simple but effective. Please make the $offset a field in your class.

This only moves you away from the simple numbers of the id, it does in no way help to secure the id.

If you think that the sequential numbers in base 36 are a problem you can add a factor. For instance the prime number 5197. Like this:

function obfuscate($number)
{
    $offset = 73074643;
    $factor = 5197;
    return strtoupper(base_convert($factor * $number + $offset, 10, 36));
}

function deobfuscate($code)
{
    $offset = 73074643;
    $factor = 5197;
    return intdiv(base_convert($code, 36, 10) - $offset, $factor);
}

Which will make it a lot harder to see any logic in the numbering:

1 = 17ICRK 
2 = 17IGRX 
3 = 17IKSA 
4 = 17IOSN 
5 = 17IST0 
4
  • 1
    This only offsets the ID by some huge number. They will still be consecutive numbers in base 36
    – Dharman
    Aug 16, 2019 at 18:19
  • 1
    @Dharman: You're right, of course, but it is compatible with the reason given for the obfuscation. Aug 16, 2019 at 18:20
  • 1
    7 is still too small. I would suggest picking a prime number e.g. 5197.
    – Dharman
    Aug 16, 2019 at 18:48
  • This is perfect! Thank you Aug 16, 2019 at 19:54
1

Base64 encoded values are still easily recongnizable.
You could create a hash of the ID e.g. $hash = hash('crc32', $input);, but a better idea would be to generate UUIDs e.g. $uuid = uniqid(); and use that instead of ID

2
  • crc32 duplicates very easy it is indeed better to generate UUID.. But in general you should not be using UUID as primary keys it's statters btree performance effectively as UUID are more random.. Aug 16, 2019 at 18:14
  • 1
    A good read about URL shortening by Jeff Atwood
    – Dharman
    Aug 16, 2019 at 18:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.