Question

In my program, we store a user’s IP address in a record. When we display a list of records to a user, we don’t want to give away the other user’s IP, so we SHA1 hash it. Then, when the user clicks on a record, it goes to a URL like this:

http://www.example.com/allrecordsbyipaddress.php?ipaddress=SHA1HASHOFTHEIPADDRESS

Now, I need to list all the records by the IP address specified in the SHA1 hash. I tried this:

SELECT * FROM records 
WHERE SHA1(IPADDRESS)="da39a3ee5e6b4b0d3255bfef95601890afd80709"

but this does not work. How would I do this?
Thanks,
Isaac Waller

Answer 1

I’d store the SHA1 of the IP in the database along with the raw IP, so that the query would become

SELECT * FROM records WHERE ip_sha1 = "..."

Then I’d make sure that the SHA1 calculation happens exactly one place in code, so that there’s no opportunity for it be be done slightly differently in multiple places. That also gives you the opportunity to mix a salt into the calculation, so that someone can’t simply compute the SHA1 on an IP address they’re interested in and pass that in by hand.

Storing the SHA1 hash the database also gives you the opportunity to add a secondary index on ip_sha1 to speed up that SELECT. If you have a very large data set, doing the SHA1 in the WHERE clauses forces the database to do a complete table scan, along with redoing a calculation for every record on every scan.