生成随机的一次性URL

Question

I'm creating a pretty simple application which allows references (of potential employees) to upload their own reference letters. Here's how it works:

• The applicant submits the references email
• The reference receives an automatically generated email containing a unique URL (for security reasons)
• Reference follows the link, answers security question (in case he wishes to access the site more than once)
• Uploads letter

I'm stuck on how to generate a completely (okay, okay, quasi will do) random URL. What's more: how do I ensure that following the link will direct the references to the correct page? Do I have to create a new page containing the drop box every time I send out a random URL?

Thanks for any suggestions on how to go about this :)

Answer 1

You might try using a hash algorithm which generates the unique-esque checksum from the contents of the file. Usually (for example with md5()) one byte change in the original content results in a completely different hash. (Notice: md5 has some collision vulnerabilities.)

If you store the uploaded file with the filename of the hash, you will be able to retrieve it at a later date, but for more complex system, there should be a database set up which makes the relation between the random URL and the stored content.

If you don't want to hash, there code snippet below could help to generate random URLs (but make sure that if an URL is already used, you prevent accidental overwrites):

md5( sha1( time() + rand(0, time()) ) );