I am about to create a website which will have a registration/login area. After the user has logged in he/she will have the ability to buy one or many modules which consist of static content regarding a topic. Of course the security on these modules is important as I want to make sure only people who have bought the package have acccess to the relevent modules.
Do you think its a good idea to store the information in a session about which user has access to which package once they have logged in so I only make a single call to the database to find out.
I go to the database everytime they access a particular module to make sure they have access to that module
I do both
there is an another way I have completely missed...
Any advice will be great. I am trying to get a balance between performance and security.