Question

Is this good enough for a random coupon code generator? Should I check and see if a code has already been used when I make a new code? What are the odds that this will repeat?

$coupon_code = substr(base_convert(sha1(uniqid(mt_rand())), 16, 36), 0, 7);

EDIT – here’s my actual code:

$coupon_code = substr(base_convert(sha1(uniqid(mt_rand())), 16, 36), 0, 7);
$numrows = mysql_num_rows(mysql_query("SELECT id FROM generatedcoupons WHERE coupon_code='$coupon_code' LIMIT 1"));
if($numrows>0){
     $coupon_code =  substr(base_convert(sha1(uniqid(rand())), 16, 36), 0, 7);
     $numrows = mysql_num_rows(mysql_query("SELECT id FROM generatedcoupons WHERE coupon_code='$coupon_code' LIMIT 1"));
     if($numrows>0)
          //error, show link to retry
}

Answer 1

Here’s a coupon system that not only guarantees unique codes, but is very efficient when it comes to looking them up:

// assuming MySQL table with (id, code, effect)
mysql_query( "insert into `coupons` set `effect`='".$effect."'");
// "effect" will be some keyword to identify what the coupon does
$id = mysql_insert_id();
$code = $id."F";
$codelen = 32; // change as needed
for( $i=strlen($code); $i<$codelen; $i++) {
    $code .= dechex(rand(0,15));
}
mysql_query( "update `coupons` set `code`='".$code."' where `id`=".$id);

// now, when you are given a code to redeem, say $_POST['code']
list($code,$effect) = mysql_fetch_row( mysql_query( "select `code`, `effect` from `coupons` where `id`='".((int) $_POST['code'])."'"));
if( $code != $_POST['code']) die("Code not valid");
else {
    // do something based on $effect
}

As you can see, it takes the ID from AUTO_INCREMENT, appends an F, then pads with random hexadecimal characters. You can make $codelen as high as you want, but 32 should be plenty (giving around 16**26 combinations even after the millionth coupon).