If you really need the IDs to be random, then generate a random number, and the three items above, and use them as input to the MD5 checksum algorithm.

Technically, that could work. As long as you're not going to have 32K sessions per second, that seems fairly unique. Problem is, I believe the poster wanted random. There's many ways you could run into race conditions in this case. I say it depends on the application as to the source of randomness and uniqueness. For example, if using a database that supports sequences, you could MD5-encrypt a sequence number with a random password, and that'd be both unique and random, as well as fairly simple. Without more information, it's difficult, though.

Update: Double posted; this should be under this node instead.
Update2: Second post had MD5 note added whereas first didn't.

You should look at Apache::Session. You can use it's internal session generation system, without using the entire module:

use Apache::Session::Generate::MD5;

#...

my $session_id = Apache::Session::Generate::MD5::generate();
[download]

You may want to explore this module more. I think it will not only allow you to easily create pseudo-random session id's, but also provide a simple interface to store and retrieve session information. I've used Apache::Session many times and I highly recommend it.

my $uniqueId = time()*10000 + int rand (10000);
$uniqueId = $uniqueId*100 + ( 
   ( ( $uniqueId div 10000000) % 10 ) * 
   ( ( $uniqueId div 100 ) % 10 ) );
[download]

Not to nit-pick, but a 'random number' is not guaranteed to be different the next time it's requested. There is a possibility two people will hit it within a second of each other (thus getting the same time) and get the same random number, thus giving them the same unique ID. Granted, the probability is low, but if you get a lot of ID requests, this will be a very real concern. I usually combine the process ID of the process making the request in with that, since it's highly unlikely you will iterate through the system's available process pool within 1 second of time, and combined with a random number like you're doing, makes it for all practical purposes completely unique.

sub unique_id() {
    # Use Apache's mod_unique_id if available
    return $ENV{UNIQUE_ID} if exists $ENV{UNIQUE_ID};

    require MD5;

    # ** Note ** This is intended to be unique, not unguessable.
    my $id = MD5->hexhash(MD5->hexhash(time.{}.rand().$$));
    $id =~ tr|+/=|-_.|;     # make non-word characters URL friendly
    return $id;
}
[download]

By using hexhash instead of base 64 you're also more likely to come up with ID that are safe to use (read, "no funny characters that might do something bad")

   # ** Note ** This is intended to be unique, not unguessable. 
    my $id = MD5->hexhash(MD5->hexhash(time.{}.rand().$$)); 
    $id =~ tr|+/=|-_.|;     # make non-word characters URL friendly
[download]

Uh, that tr never fires there. hexhash always generates hex chars. Perhaps you're confusing this with the base64 versions that I was trying to steer the other petitioner around.

-- Randal L. Schwartz, Perl hacker

RE: Random number (CGI Security)

Russ
Brainbench 'Most Valuable Professional' for Perl

              (__)
              (\/)
       /-------\/
      / | 666 ||
     *  ||----||
[download]