I have a module that I cache some details (w/c is from the input of the user) to lessen the load of my database

The way how I cache is by creating html page with the details of the user using fwrite();

the problem is after I try the module of the user, if I input this

 echo "this is from the input of the user";

inside the textarea. After that this details will going to cache, and then when I load the cache file the php code was executed.

The only solution that I have is to strreplace() this character <? from their input. Is there any solution?

1 Answer 1


The solution is to not cache like this. For a start, <? is only one of several ways to inject PHP, including <script language="PHP"> and <?php. Blacklists are always a bad idea.

Your caching system doesn't work in the first place in terms of performance because, by the time your PHP serving becomes a performance problem, your disk performance becomes a problem too. At that point you're not improving performance at all.

For proper caching, you want in-memory storage. Take a look at memcached (and the PHP module), APC, or an in-memory NoSQL solution like Redis. These are mature projects that were designed to do exactly what you're trying to do.

  • thanks polynomial ill try to study first your suggestion, by the way have you hear about sphinx? is it good to use for my database performance to avoid caching. Nov 7, 2012 at 15:17
  • @EfazAÑecohJ-ra Sphinx is an indexing engine allowing for fast searches of data, but it doesn't cache the data itself.
    – Polynomial
    Nov 7, 2012 at 15:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .