What are some resources to learn about the best practices while building URL's for a website?

This is a follow-up question to Why are the query parameters for many websites(MySQL) very cryptic long integers?. In terms of security and scalability. Please cite 开发者_StackOverflowany resources(online/offline).

---

In terms of security and scalability you can use whatever urls you imagine.

It's usually human readability and and usability or (more often) search engine friendship that affects URL building rules.

Say, PHP.NET famous php.net/echo feature giving fast and easy access to function description. That's the reason to make such urls, not security.

---

Security and scalability have little to do with the way an URL is formed. Some sites do use cryptic URLs as a measure for securing pictures (e.g. Facebook), this type of security is generally frowned upon, as everyone knowing the URL through various ways (browser cache, proxy cache, ...) can access the supposedly protected resource.

While a clean URL helps the search-engine-optimization, it usually means slower response and thus a degraded scalability. Consider an URL http://example.com/user/Lars, showing you the profile page of my profile. If my account is linked in the database not by my accountname but by a surrogate key (some arbitrary number), the system first has to query the user table for my surrogate key in order to get the rest of the information. This degrades performance, as one more table has to be queried.

---

While I agree completely with Col. Shrapnel answer there are a few cases where long "cryptic" IDs contribute to security and sometimes even scalability. Sharelockers (RapidShare and friends) usually employ the /ID/Filename structure in their URLs to add security through obscurity, it would be far too easy for someone to test all integers or common filenames and get access to sensitive information.

Some people also apply some kind of checksum algorithm to their database IDs, this makes it harder for someone to figure out the underlying structure and "hide" certain kinds of information: I bet many people would be reluctant to pay for something online if the URL for the order was /order/2/ for instance. Using checksums can also contribute for improved performance, since you can disregard invalid IDs without even having to query the database (useful when someone is brute-forcing your URLs).

Long IDs contribute to scalability, in the sense that they provide a wider range of possible numbers (Slashdot had been a victim of the "int(11) is more than enough for everyone" assumption twice - sorry can't find old story), and that's why you see Twitter and friends using different approaches nowadays.

When you use a wider ID you can also store more information, such as timestamps, IP / hostname that created the database record and so on, which can be crucial when you're running a distributed database setup. Take a look at the MongoID class documentation to get a better idea how it works.