Stopping people from brute forcing URL / UUIDs

[eluser]bretticus[/eluser]
Well, forgive me if I do not understand your problem in it's entirety. However, if we are thinking about the same problem, I have become accustomed to having a sequential auto-incremented id for my database records (primary key) and another random key (UUID) in addition. When I pass a URL out for public consumption, I simply use the UUID to look up the record. In the managerial side of the website, I'll use the sequential number (or id.) In CI, a UUID of sorts is easy to generate with the string helper. I use the random_string() function. Works rather nicely.