I want to implement an order tracking options where people just enter their order number and then the script will tell them when the order was shipped out. The script is pretty basic, we can probably have it ready in a few hours. However, our order number is generated sequencially. If we implement such script, anybody who feeds in a valid order number will be able to find how many sales we are getting. As a webmaster myself, if I find a site that I can get such important data, I would definitely use this "feature" to my fullest advantage. And of course, I can't allow that to happen.
I understand that if I fix the algorithm that generates the order number, this problem will be resolved. But it will be a big change because it will affect all other backend scripts.
Is there anyway other way I can prevent such exploit?
