Question

I have a PHP website which acts as a web proxy/anonymizer, and I have it set up where each visited page is cached on my server for a limited time. To further secure things, I would like to encode the URLs into a set of hexadecimal characters, but it needs be be unique enough to where no 2 URLs will ever clash together; The cached page’s file name will reflect the encoded URL, so I can’t allow them to be overwritten by the visitation of another page.

Meanwhile, I’ve been using this:

$file = str_shuffle(preg_replace("/[^a-zA-Z0-9\s]/", "", urlencode($url))) .".html";

… But the problem here is that it’s always random and not guaranteed to be fully unique. I’d like to make it so that users can bookmark their URLs (and revisit them within a given time period, without having to re-navigate to the page). How can I generate such a string?

Answer 1

If you need a “secure”, as in not reversible, unique “encoding” of a URL, that’s what hashes are for:

$hash = sha1('http://...');

The value will be unique for each URL, two identical URLs will hash to the same value, they’re not reversible and are for most intents and purposes random values.

If you’re talking about encoding (changing from one form to another) or encrypting (changing into another form using a secret key), then you’re talking about reversible algorithms, in which case the result is unique by definition. Encoding the string won’t be “secure”, since there’s no secret. Encrypting the string is as secure as you keep the secret.

So you have three choices:

1. encoding (e.g. url_encode, base64_encode), which is not secure and reversible
2. encryption (e.g. AES), which uses a secret and is secure and reversible
3. hashing (e.g. SHA1), which is not reversible and thereby secure

All three result in unique values (good hashes have a mathematically high enough probability to result in unique values).