title: Need a smaller alternative to GUID for DB ID but still unique and random for URL
body: <p>I have looked all of the place for this and I can't seem to get a complete answer for this. So if the answer does already exist on stackoverflow then I apologize in advance.</p>
  
  <p>I want a unique and random ID so that users in my website can't guess the next number and just hop to someone else's information. I plan to stick to a incrementing ID for the primary key but to also store a random and unique ID (sort of a hash) for that row in the DB and put an index on it.</p>
  
  <p>From my searching I realize that I would like to avoid collisions and I have read some mentions of SHA1. </p>
  
  <p>My basic requirements are</p>
  
  <ul>
  <li>Something smaller than a GUID. (Looks horrible in URL)</li>
  <li>Must be unique</li>
  <li>Avoid collisions</li>
  <li>Not a long list of strange characters that are unreadable.</li>
  </ul>
  
  <p>An example of what I am looking for would be www.somesite.com/page.aspx?id=AF78FEB</p>
  
  <p>I am not sure whether I should be implementing this in the database (I am using SQL Server 2005) or in the code (I am using C# ASP.Net)</p>
  
  <p>EDIT:</p>
  
  <p>From all the reading I have done I realize that this is security through obscurity. I do intend having proper authorization and authentication for access to the pages. I will use .Net's Authentication and authorization framework. But once a legitimate user has logged in and is accessing a legimate (but dynamically created page) filled with links to items that belong to him. For example a link might be www.site.com/page.aspx?item_id=123. What is stopping him from clicking on that link, then altering the URL above to go www.site.com/page.aspx?item_id=456 which does NOT belong to him? I know some Java technologies like Struts (I stand to be corrected) store everything in the session and somehow work it out from that but I have no idea how this is done.</p>