Is there any DC module or configuration that would allow me to set an alias for the order number that is shown on the checkout path.


Instead of example.com/checkout/10

Something like example.com/checkout/order or just plain example.com/checkout

An alias module would have similar functionalities as the me module.

  • Couldn't path-auto solve this? I haven't investigated, but the functionality you are requesting looks just like the normal node aliases provided by path aliases.
    – Letharion
    Feb 7, 2013 at 8:52
  • @Letharion Path auto does not allow place-holders I am afraid. For instance, it does not accept checkout/% Feb 7, 2013 at 10:02
  • Of course it does, what else would be "auto" about it? "Everyone" uses it for node/%.
    – Letharion
    Feb 7, 2013 at 10:20
  • @Letharion Yes but the node/10 gets converted to blog/my-title-1 and node/11 to blog/my-title-2 and so on. It wont work converting all the checkout/% to checkout/order. It does not have the option, as node, taxonomy and user do, for setting checkout/[customer-name] or something. Feb 7, 2013 at 12:16
  • 1
    Ah, now I understand more, I missed the "me" module and it's description before. That's very different from an alias though, which is what confused me. Can a user only have one order in your system? Otherwise I don't see how this makes sense?
    – Letharion
    Feb 7, 2013 at 12:26

3 Answers 3


I to went that road, did not want customers to see an on each order incrementing ID in URL's. In hook_url_outbound_alter() any path can be encrypted by altering the regular expression.

 * Implements hook_url_inbound_alter().
function mymodule_url_inbound_alter(&$path, $original_path, $path_language) {
  // Decrypt paths that are encrypted by our hook_url_outbound_alter() to hide possible id's in paths.
  if (preg_match('#^ENC:(.+)#', $path, $m)) {
    $path = _mymodule_mcrypt('decrypt', $m[1]);

 * Implements hook_url_outbound_alter().
function mymodule_url_outbound_alter(&$path, &$options, $original_path) {
  // To hide id's in paths, we encrypt them.
  if (preg_match('#^checkout/.*#', $path, $m)) {
    $path = 'ENC:' . _mymodule_mcrypt('encrypt', $path);

 * Helper function to encrypt and decrypt strings, ie. paths to hide containing id's.
 * NB: We replace forward slashes for exclamation marks, otherwise trailing 
 *     slashes in the URL will be ignored by Drupal.
function _mymodule_mcrypt($action, $string, $key = null) {
  if (!$key) {
    $key = $GLOBALS['drupal_hash_salt'];

  $mcrypt_method = MCRYPT_RIJNDAEL_128;
  $iv_size = mcrypt_get_iv_size($mcrypt_method, MCRYPT_MODE_CBC);

  // Make key exactly as long as long as $iv_size.
  $key = substr(str_repeat($key, CEIL($iv_size / strlen($key))), 0, $iv_size);

  if ($action == 'encrypt') {
    $iv = mcrypt_create_iv($iv_size, MCRYPT_RAND);
    $encrypted_string = base64_encode($iv . mcrypt_encrypt($mcrypt_method, $key, $string, MCRYPT_MODE_CBC, $iv));
    return preg_replace('#/#', '!', $encrypted_string);
  elseif ($action == 'decrypt') {
    $decrypted_string = base64_decode(preg_replace('#!#', '/', $string));
    $iv = substr($decrypted_string, 0, $iv_size);
    $decrypted_string = substr($decrypted_string, $iv_size);

    return rtrim(mcrypt_decrypt($mcrypt_method, $key, $decrypted_string, MCRYPT_MODE_CBC, $iv));

  return false;

I just realized that my goal is not feasible because the system could not distinguish orders of an unique user who has more than one order in the system.

I will encrypt the order number bit by implementing hook_url_outbound_alter() and hook_url_inbound_alter().


Hopefully there is a new Drupal module for that named Commerce_Checkout_Paths.

Commerce Checkout Paths admin page

  • Cool. I will definitely try it out. Cheers. Jan 15, 2015 at 22:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.