Is it bad to expose user IDs?
Exposing an user ID is not, in and of itself, bad. It depends on the level of privacy and security needed. If the user ID does not expose and cannot be tied to any other personal data that should otherwise be private, it may not be a problem.
Is it good to expose primary key?
It’s entirely fine to expose keys for technical uses. Also, if you do use some surrogate value instead, that’s not necessarily more secure. Yes, exposing keys is information that can be used as an attack. Especially if they are predictable.
Why are sequential IDs bad?
It’s also extremely bad for db performance, causes massive page fragmentation, indexes become useless almost straight after rebuilding them, etc. For almost everything, sequential int IDs are fine.
What should you do with a database ID?
From the perspective of code design, a database ID should be considered a private implementation detail of the persistence technology to keep track of a row. If possible, you should be designing your application with absolutely no reference to this ID in any way. Instead, you should be thinking about how entities are identified in general.
Is it safe to expose a database ID?
Otherwise the URL itself should be secret. EDIT: if the URL is secret, it will probably contain a generated token that has a limited lifetime, e.g. valid for 1 hour and can only be used once. EDIT (months later): my current preferred practice for this is to use UUIDS for IDs and expose them.
Can a single server generate all the IDS?
In simple cases, a single physical server can generate all IDs in the application. In more complex systems, multiple servers might need to handle this task, but, since all of them are under your full control, you can be relatively confident that you know what’s going on and there will be no surprises.
How to generate unique patient ID in MySQL?
The only guaranteed unique key is all of the fields together. A web application can easily retrieve this data for a given patient by selecting for patient_id, but unless it is possible to save pointers to rows inside a database with multiple users, it strikes me as a clumsy system for editing or deleting rows in this table.