I'm generating 9-character order confirmations such as K1YBFRG17, O1D15ZCOM, etc and using them as order confirmation numbers. It's basically just picking at random from the string
'ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890' nine times.
While this allows for 36**9 different IDs, which I believe is around a hundred quadrillion, and the likelihood of a repeat is infinitesimal, I'm just wondering how this would be looked at from a security standpoint. Is it important to sweep the database each time a new ID is generated, and make sure that it's unique, even if there's almost no chance of it?