Creating a unique directory for each users data on the fly and checking for any collisions

Question

Thanks for all your help - see blow original question, and my edit following the two line rules (I cannot yet answer my own questions as a new user..).

I've looked around and question (here) almost meets the aims of my question:

For example, I'm creating a user data directory for each user on a web application; the folder of-course must be unique but also abstract for security (using their user id for example, would not be appropriate.

So far I've created the following function; it generates a unique folder name, checks to make sure it doesn't already exist and assigns it to a variable. It then loops back if the dir already exists:

function generate_unique_userDirectory(){
    $userDirectory = md5(uniqid($uid)); //Generate a unique folder name.
    if (is_dir($userDirectory)) {
        return FALSE; //If the dir exists, report so
    } else {
        return $userDirectory; //Return unique foldername
    }
}

While loop is used to keep going until an unused folder name is found.

while (!$userDirectory = generate_unique_userDirectory()) {
    echo 'folder exists...loop back try another';
    //Try another:
    $userDirectory = generate_unique_userDirectory();
}

Is there a better way of doing this, my main concern is whether I'm over-complicating the procedure?

Many thanks for your time.

---

My findings thanks to all that contributed!

Thanks @Veger, and everyone else; your assistance was brilliant; I've since re-worked the function based on your advice:

function generate_unique_userDirectory($uid){

        $userDirectory = md5(uniqid($uid));             

            while (is_dir(BASE_URI . "$userDirectory")){

                $userDirectory = md5(uniqid($uid));
            }

            return $userDirectory;

        }//End of generate_unique_userDirectory funcation decleration.

            //Example call to function:
        $userDirectory = generate_unique_userDirectory($uid);

            echo "The generated user directory is: $userDirectory";

As suggested, I've put the folder name generation while loop within the function which now makes the function call much simpler.

In response to your second bullet point @Veger, it is my understanding that as I've fed the 'uniqid' function to the md5 function this will result in a new string each time (though I may have misunderstood).

The purpose of passing the $uid to generate_unique_userDirectory() is to further 'salt' the generated string, however, I may be taking it a step too far!

Many thanks to all- a great first time on stackoverflow...

Answer 1

The sensible solution would be to use the primary key or some other unique value. Since that is not an option using uniqid (collisions should be inexistant in practise) would make sense but you could also generate a hash from unique keys for a given user and perhaps use that for a lookup mecanism.

$userDir = "/users/" . md5( $user->id . $user->username . $user->email );

If you want to be extra careful, make sure you don't expose the used data anywhere so the path can't be reconstituted. You can also add a level of security by using url rewriting to redirect requests with certain arguments to a PHP script. That way you can do things like check sessions, IPs and so on.

Answer 2

Some of my thoughts on your design:

• As Wesley already commented generate_unique_userDirectory() suggests that the returned directory is unique. So you should not need to check after calling whether its result is a unique directory or not...
• Calling the function a second time results in the same failure, as $uid is not changed for the new user.
• If it does change, why not put your while loop inside the function? So it always returns a unique directory.
• By calling the function in the while-statement and in the loop itself, results in it being called twice after failure. First call in the loop which is overridden by the call in the statement.

Answer 3

My suggestions:

To achieve unique folders:

Just create folders with md5 of the user_id.

To achieve security:

Place the folders offline, not on the web path and create a class or script to access each of the file resources.

Scalability:

By having a class or script to access to users files you can later use it as bridge to switch to another storage mechanism like Amazon S3 or similar cloud services.

Answer 4

imho, it's normal aproach. there will be mostly one iteration since md5 has too low possiblity of collision. one think i don't like in your code:

if (is_dir($userDirectory)) {
    return FALSE; //If the dir exists, report so
} else {
    return $userDirectory; //Return unique foldername
}

there might exists regular file with the same name. it's better to check with file_exists()

Answer 5

   function generate_unique_userDirectory($uid){
        $userDirectory = md5(uniqid($uid.time())); //Generate a unique folder name.
        if (is_dir($userDirectory)) {
            return generate_unique_userDirectory($uid); //If the dir exists, report so
        } else {
            return $userDirectory; //Return unique foldername
        }
    }

Why not make your function recursive? If the generated directory is already in use, the script will keep on trying untill it generates an unique directory. This should be the result of the function, hence the name ;-)