我应该使用“id”吗？ 或“唯一用户名”？
我正在使用 PHP、AS3 和 mysql。
我有一个网站。 一个 flash(as3) 网站。 flash网站通过php将会员信息存储在mysql数据库中。 在“members”表中，我将“id”作为主键，将“username”作为唯一字段。
现在我的情况是： 当flash想要显示会员的个人资料时。 我的问题：
Flash应该将成员“ID”或“用户名”传递给php来处理mysql查询吗？
传递“id”或“用户名”有什么不同吗？
哪一个更安全？
您推荐哪一个？
我想在安全性和性能方面优化我的网站。
I am using PHP, AS3 and mysql.
I have a website. A flash(as3) website. The flash website store the members' information in mysql database through php. In "members" table, i have "id" as the primary key and "username" as a unique field.
Now my situation is:
When flash want to display a member's profile. My questions:
Should Flash pass the member "ID" or "username" to php to process the mysql query?
Is there any different passing the "id" or "username"?
Which one is more secure?
Which one you recommend?
I would like to optimize my website in terms of security and performance.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
1) 毫无疑问，这两者都不是它应该做的事情。
2) ID 可能更短并且查找速度更快。 该 ID 会透露更多有关您的系统的信息； 如果您知道某个站点完全使用序列 ID，并且知道其中之一是什么，那么这与了解所有序列 ID 一样好，而知道一个用户名并不能告诉您任何其他用户的用户名。 另一方面，用户名更能揭示用户的心理，可能构成密码提示。
3) 两者都有极小的缺陷，如第 2 项中所述。
4) 我会使用 ID。
1) Neither is inarguably the thing it should do.
2) The ID is probably shorter and minisculely faster to look up. The ID gives away slightly more information about your system; if you know that a site uses serial IDs at all, and you know what one of them is, that's pretty much as good as knowing all of them, whereas knowing one username does not tell you the usernames of any other users. On the other hand, the username is more revelatory of the user's psychology and may constitute a password hint.
3) Both have extremely marginal downfalls, as described in item 2.
4) I'd use the ID.
主键始终是识别数据库行的最安全方法。 例如，您稍后可能会改变主意并允许重复的用户名。
根据 ActionScript 与 PHP 通信的方式，如果您在请求中发送整数 ID 而不是用户名，则可能需要发送更少的字节。
The primary key is always the safest method for identifying database rows. For instance, you may later change your mind and allow duplicate usernames.
Depending on how your ActionScript is communicating with PHP, it will likely also require sending fewer bytes if you send an integer ID in your request rather than a username.
传递 ID 号的参数：
人们永远不会更改他们的 ID。 人们确实会改变名字。 对于拥有一次性帐户的休闲游戏网站来说，这可能不是问题，但对于长期注册用户来说可能是问题。 我不得不处理一位心烦意乱的女士提出的要求，要求将她前夫的姓氏从她的用户名中删除。 必须迅速建立一个执行此操作的流程！
更短
更容易索引和分区。
传递用户名的论据：
Arguments for passing id number:
People never change their id. People do change their names. For a casual games site with disposable accounts, that might not be a problem, but for long-term registered users it can be. I've had to handle a demand by an upset woman that her ex-husband's surname be purged from her user name. A process for doing this had to be rapidly established!
Shorter
Easier to index and partition.
Arguments for passing user name:
也许您应该非常熟悉“PHP 会话”，也许使用已经具备此功能的框架，因为它很重要，您不想把它搞砸。 然后，会话管理软件将为您处理所有这些问题，包括登录屏幕、“我忘记了密码”等。
然后您可以将注意力集中在您的网站的真正主要用途上。
听起来很有趣（actionscript + php + mysql） - 祝你好运！
Probably you should get intimately familiar with "PHP Sessions", maybe using a framework that already has this in place, because it's non-trivial and you don't want to mess it up. The session management software will then handle all this for you, including login screens, "I forgot my password", etc.
Then you can focus your attention on what your site is really primarily there for.
Sounds like fun (actionscript + php + mysql) - good luck!