database versus xml

clairence

I have a simple site I'm working on that displays user-supplied information.

Users fill a form, it's stored in mysql database.

Other users come, look up the active listings, and see the information.

I've recently been playing around trying to learn simplexml, and so have written a page that pulls the active data from the database and puts it into a simplexml file in a private folder. The theory was that it would be safer pulling from a private file than running database calls.

Anyway, I don't expect much more than a hundred listings at a time being active, which will keep the simplexml file relatively small.

My question is, is it quicker/more efficient/ and safer to have PHP pages pulling data from a simplexml file in a private folder than it is to pull from a mysql database?

thanks.

NogDog

I would say it's just the opposite: quicker and safer to use a database. DMBS's are designed from the ground up for the efficient storage, retrieval, searching, and sorting of data. XML is designed for providing a standardized means of exchanging data between discreet applications via text files with a known protocol.

clairence

Hmm.
Well that's not really what I wanted to hear, since I'd spent the time turning it the other direction.
But I appreciate your reply.

You make a good point about database design. I have heard lots about injection attacks and other mySQL DB problems, and thought I could simply use a 'hidden' (private) xml file and avoid those risks. My understanding of private files is they're inaccessible from the web, so I thought there were no possible security issues to worry about then. Perhaps if there are, someone could point them out?

Believing I had avoided security issues, I started wondering whether it was quicker and easier on the server to call a database once per page load, or to call an xml file once per page load. That was the impetus of my question.

I'll certainly have to reconsider my motivations, and maybe I'll go back to using database calls.

Further input is welcome.

Thanks.

laserlight

You make a good point about database design. I have heard lots about injection attacks and other mySQL DB problems, and thought I could simply use a 'hidden' (private) xml file and avoid those risks. My understanding of private files is they're inaccessible from the web, so I thought there were no possible security issues to worry about then. Perhaps if there are, someone could point them out?

If you have a MySQL database, the database files themselves are inaccessible from the web, or at least they should be inaccessible. This makes them no different from your XML files.

The problem with SQL injection is not restricted to MySQL. XML files are not immune to the problem: if you fail to properly escape your input, malicious users can inject their own XML files. I have seen this technique used in a message board that failed to escape HTML correctly, upon which users were able to impersonate other users by adding on HTML to their own posts such that it appears that the other user posted right after (or before) them!

Believing I had avoided security issues, I started wondering whether it was quicker and easier on the server to call a database once per page load, or to call an xml file once per page load.

Even if loading and parsing the XML file is measurably faster than connecting to the database and executing an SQL statement (and I have my doubts, since XML documents frequently contain duplication which slows down a file read), there are other factors to consider. For example, are you able to perform fast sorting and searching operations on the XML document? There are things like XPath, but I have no idea how it compares to highly optimised relational database operations.

clairence

Thank you, laserlight. More food for thought.

FWIW, I'd already been working with mySQL.

I have the site set up so the form inputs are saved to database, using mysql_real_escape_string().
Then I run a cron once a day to extract the active data and put it into an xml file.

But I do still need a way for current form data to end up in the xml file before the next cron. So yes I can see how if I made a mistake with escaping the inputs I might end up with problems.

I have not really looked at Xpath yet. Still toying with simplexml.

And I'm nowhere near "highly optimized" database work. I'm currently just happy when I can get stuff saved from a form and then retrieve it later.

Much appreciated.

djjjozsi

i was working with a music database, from a music store i had to make xml files,
and the sites and the artist's sites build with xml files.

xml is an old fashion mode, if i had to add another field to the xml, i must re-generate more than 3000 xml files.

If we worked with database, and on the fly method, it takes for about 2 seconds to do.

There were ristricted characters, for example ? or & , but there are artists which contains & sign.

so forget it.