I have Mysql database with an API tied to it to call and run PHP code stored in that database. Yes, you heard right, PHP Code stored and run from a Mysql database. So, this is pretty serious from a security standpoint, and that is my dilemma. Your first suggestion might even be,"NO, Bad!". Fear not, it can be done. There are a few good reasons for doing this.
- 40x speed increase (no HD reads)
- Automatic Dependency Injection.
- Other Programming Languages.
Input sanitation would "seem" to be the most important thing here, and my filter is top notch. SQL Injection would be your worst nightmare.
My question is this: When running live code from a database, can it be defendable, can it be attacked? What attack vectors could be possible? And how could you defend?
In summary, I need expert advice, Worst-Case, Best-Case, Do this, Don't do this. You are insane, something.
UPDATE1: I will be reading all comments over and over, The Truth Matters.
- I am using a percona mysql cluster, measurable speed is occurring (stored in ram)
- Versioning is easy (and built in) Got a table with L(language) FunctionName Vars Deps RequiredVars VERSION# etc...etc.
- I Would add for interest level, that An application could be mostly integer based, in which case input can be sanitized by casting to (int) (IE. $num = (int)$_GET['s']; )
- I highly welcome ideas, suggestions, and topics. As I believe this breaches many barriers while reaching new ones and am now fully willing and pre-dedicated to figuring this out, that part is a done deal; O, The Humanity! But I believe this CAN be successfull.
- Another added benefit is language neutrality, since I store my code in a database, labeling one code as PHP and one as RUBY or PYTHON, has serious uses. Nothing a little php-shellexec action cant make beautiful (again with near-perfect input sanitation in mind)
Will Continue to update (i have a busy schedule, but I will be as attentive as I possibly can.)