I agree with dbmab, you don't display an order number UNTIL the order is confirmed. Basically they could NOT click confirm and just leave the purchase unfinished and now you have a record in your DB which is blank, and meaningless.