1

So I've been tasked with creating a form, collecting a few personal details. I think writing to a text file would make life easier than a MySQL DB.

I've read through https://css-tricks.com/serious-form-security/ and was wondering what other things I should have in mind?

  • Following OWASP
  • HTTPS

Am I right in thinking that writing to a text file would make life easier and/or more secure than using MySQL/MariaDB?

The form is basically a "register your interest" form so would contain:

  • Title
  • Forename
  • Surname
  • Email address
  • Postal address

I am thinking a DB solution is the way to go as we'd need to verify their emails. With that in mind, would a querystring verification coupled with an ID they have to type in, suffice?

3
  • Can you add a bit more detail? What are "personal details"? Is there some form of authentication (login, etc)? Or do anonymous users supply things like their name, email address, etc?
    – tim
    Mar 23, 2017 at 11:59
  • It's a "register your interest" form so Title, Name, Email, Comments. No login but thinking about it, I'd want a way to authorise their email address (send link which they click on which approves the 'account')
    – pee2pee
    Mar 23, 2017 at 12:10
  • Make sure the text file you write to is not in your web root.
    – Anders
    Mar 23, 2017 at 12:26

3 Answers 3

3

No, a database is best for storing information gathered from a web form as you can query it much easier than a text file. Following OWASP and using HTTPS are best practices, and for a simple form should be more than enough from the form's perspective.

2
  • Thanks - I soon realised a text file would be no-go as we'll have to query the data at some point. It's better in terms of usability but in terms of security, is there a preference? I guess using MySQL would provide a larger attack surface but writing directly to a file doesn't fill me with confidence
    – pee2pee
    Mar 23, 2017 at 11:07
  • Security wise it's probably a mixed bag, either way you go you can do Access Control permissions on either a file or database/table in the database. Due to the nature of needing to query information out, you're going with the database regardless, so you should focus on making sure you're not using credentialed users to run the MySQL instance, making sure auditing of user activity in the database is on, etc.
    – Ryan Kelso
    Mar 23, 2017 at 13:06
0

One important thing to take care is to make server-side validations, because client-side validation, however elegant it may be, can be turn off.

1
  • Yup - got that covered. Prepared statements for DB along with other checks will be in place
    – pee2pee
    Mar 23, 2017 at 13:00
0

I think writing to a text file would make life easier than a MySQL DB.

The write is easier on a test system but in production you will start running into lots of problems. Read performance will decline rapidly as the file gets bigger. You will need locking semantics to prevent concurrent modifications and write performance will decline. The structure of the data will be immutable without amending all the code which accesses it. It will only be available on the host where the webserver sits (unless you go in for even more complex locking strategies). Your system won't scale easily.

I am thinking a DB solution is the way to go as we'd need to verify their emails

I don't see why that has anything to do with the choice of storage.

would a querystring verification coupled with an ID they have to type in, suffice?

That's a completely seperate question, and we can't tell you what your verification requirements are.

2
  • My thought about verification would be reading/update a single row in a table rather than updating what could potentially be a massive file
    – pee2pee
    Mar 23, 2017 at 13:29
  • Given that its the wrong solution for lots of other reasons, I don't want to get bogged down in a discussion of how a file based solution might work (and it would off-topic on a Security board) however there are lots of approaches where you could avoid the performance issue for this specific update.
    – symcbean
    Mar 23, 2017 at 13:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.