0

I have a module that I cache some details (w/c is from the input of the user) to lessen the load of my database

The way how I cache is by creating html page with the details of the user using fwrite();

the problem is after I try the module of the user, if I input this

<?php 
 echo "this is from the input of the user";
?>

inside the textarea. After that this details will going to cache, and then when I load the cache file the php code was executed.

The only solution that I have is to strreplace() this character <? from their input. Is there any solution?

Improve this question

1 Answer 1

Reset to default
5

The solution is to not cache like this. For a start, <? is only one of several ways to inject PHP, including <script language="PHP"> and <?php. Blacklists are always a bad idea.

Your caching system doesn't work in the first place in terms of performance because, by the time your PHP serving becomes a performance problem, your disk performance becomes a problem too. At that point you're not improving performance at all.

For proper caching, you want in-memory storage. Take a look at memcached (and the PHP module), APC, or an in-memory NoSQL solution like Redis. These are mature projects that were designed to do exactly what you're trying to do.

Improve this answer
2
  • thanks polynomial ill try to study first your suggestion, by the way have you hear about sphinx? is it good to use for my database performance to avoid caching.
    – Efaz AÑecoh J-ra
    Commented Nov 7, 2012 at 15:17
  • @EfazAÑecohJ-ra Sphinx is an indexing engine allowing for fast searches of data, but it doesn't cache the data itself.
    – Polynomial
    Commented Nov 7, 2012 at 15:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .