title: Obfuscating GET id variables with encryption, surrogate key, etc
body: <p>I'm working on a new application, and in order to obscure the perception of its infancy, I'd like to obscure any instances that could reveal this, for example,<br>
  <code>$postId=000001</code>. Instead we'd get <code>$postId=sH4d6s8d</code>. Something short-ish, but unique.</p>
  
  <p>I've read through a few other questions, unfortunately most answers devolve into security concerns. Application security isn't an issue here, I'm just looking for a way to pass an obscure representation of a row id through GET, and have that URL be sharable, meaning multiple user machines can interpret the obfuscation.</p>
  
  <p>I skimmed over surrogate keys for MySQL, XOR, but I'm pretty green and my comprehension went mush quickly. What's the appropriate solution here? Any examples? Thanks.</p>
  
  <p><strong>Update</strong></p>
  
  <p>Decided on a simple XOR + urlencode solution. i.e:</p>
  
  <pre><code>$v = urlencode($var ^ $key)
  $v = (urldecode($v) ^ $key)
  </code></pre>
  
  <p>From testing so far, this seems great for my purposes. However, looks like Firefox auto-decodes <code>urlencode</code> for display, defeating the whole purpose of the idea:</p>
  
  <pre><code>$v = r%5CQXr%5CQXr%5CP
  &lt;a href="whatevs.php?id=$v"&gt;link&lt;/a&gt;
  
  // Firefox renders the below anywhere link is visible (besides source)
  
  whatevs.php?id=r\QXr\QXr\P 
  </code></pre>
  
  <p>This is annoying. While the id is still obscured and the source is sill "traditionally" urlencoded, those characters don't look natural in a url. But the real problem is anyone who copy/pastes the link won't get the correct resource.</p>
  
  <p>Is there a easy fix for this?</p>