Generating a time-based unique file name for uploads without creating a race condition

Question

I'm generating a unique filename for uploaded files with the following code

$date = date( 'U' );
$user = $_SERVER[REMOTE_ADDR];
$filename = md5($date.$user);

The problem is that I want to use this filename again later on in the script, but if the script takes a second to run, I'm going to get a different filename the second time I try to use this variable.

For instance, I'm using an upload/resize/save image upload script. The first operation of the script is to copy and save the resized image, which I use a date function to assign a unique name to. Then the script processses the save and saves the whole upload, and assigns it a name. At the end of the script ($thumb and $full are the variables), I need to insert into a MySQL database, the filenames I used when i saved the uploads.

Problem is, sometimes on large images it takes more than a second (or during the process, the seconds change) resulting in a different filename being put into the database than is what the file is actually saved under.

Is this just not a good idea to use this method of naming?

Answer 1

AFAIK it's a great way to name the files, although I would check file_exists() and maybe tack on a random number.

You need to store that filename in a variable and reference it again later, instead of relying on the algorithm each time. This could be stored in the user $_SESSION, a cookie, a GET variable, etc between pageloads.

Hope that helps

Answer 2

Just want add that php has a function to create identifiers: uniqid. You can also prefix the identifier with a string (date maybe?).

Always validate your user's input, and the server headers!