Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a module that I cache some details (w/c is from the input of the user) to lessen the load of my database

The way how I cache is by creating html page with the details of the user using fwrite();

the problem is after I try the module of the user, if I input this

<?php 
 echo "this is from the input of the user";
?>

inside the textarea. After that this details will going to cache, and then when I load the cache file the php code was executed.

The only solution that I have is to strreplace() this character <? from their input. Is there any solution?

share|improve this question
add comment

1 Answer

up vote 5 down vote accepted

The solution is to not cache like this. For a start, <? is only one of several ways to inject PHP, including <script language="PHP"> and <?php. Blacklists are always a bad idea.

Your caching system doesn't work in the first place in terms of performance because, by the time your PHP serving becomes a performance problem, your disk performance becomes a problem too. At that point you're not improving performance at all.

For proper caching, you want in-memory storage. Take a look at memcached (and the PHP module), APC, or an in-memory NoSQL solution like Redis. These are mature projects that were designed to do exactly what you're trying to do.

share|improve this answer
    
thanks polynomial ill try to study first your suggestion, by the way have you hear about sphinx? is it good to use for my database performance to avoid caching. –  Efaz AÑecoh J-ra Nov 7 '12 at 15:17
    
@EfazAÑecohJ-ra Sphinx is an indexing engine allowing for fast searches of data, but it doesn't cache the data itself. –  Polynomial Nov 7 '12 at 15:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.