PHP Best Practices

rhinovaley

Hello! I'm a little new to PHP/MySQL and feel pretty comfortable with them, but because I'm self taught I'm not quite sure of some "best practices" that I should be aware of. I've searched around on the forums here and Google, but can't quite find what I'm looking for. If somebody could help me, that would be very appreciated!

First, I have a question about php sessions verses MySQL queries. Is it a bad thing to have many php sessions and do more database queries, or are php sessions better to do. My main concern is with performance and system resource usage. Currently, I have a login system that stores a few variables such as username, password, and user type in a session variable when they login, but I have gotten to a point where on almost every page I will need about 20 different things about the user. Would it be better to store all of these things in sessions, run a query every time they are needed, or is there another method. I would like to stay away from client-side cookies as I don't want the majority of the information to be able to be changed, and I generally have a distrust with cookies.

Secondly, I have a question about a commenting system. Is it okay to store comments in a database, or is this bad on system performance if somebody is viewing the comments and all of the comments are pulled from the database? The only other way I would know how to store comment information is in text files, but I find database integration easier. My main concern would be 20 comments on a page with 2000 characters each, and whether or not it would be okay to store all of that information in a database. On the same note, if I stored the information in text files instead, could it be easy for a hacker to change this information?

Lastly, if you have any general php best practices you feel I should be aware of when coding, I would love to hear them. Thanks for reading this, and I hope you can help.

jazz_snob

rhinovaley;10901294 wrote:
First, I have a question about php sessions verses MySQL queries. Is it a bad thing to have many php sessions and do more database queries, or are php sessions better to do.

That depends on what you're trying to do. If you are tracking information about the user, a session is a good place for that.

...I will need about 20 different things about the user. Would it be better to store all of these things in sessions, run a query every time they are needed, or is there another method.

I've taken to storing all of it in the database. That said, I actually use $_SESSION in my php code but the session is saved automatically to a table in the database rather than to a file in /tmp directory. I do this for security reasons as my code is often deployed on shared-hosting environments.

I would like to stay away from client-side cookies as I don't want the majority of the information to be able to be changed, and I generally have a distrust with cookies.

It depends what you put in a cookie. The only values ever use are sha1 hashes. I tell php to store the session on the client using a cookie and typically the cookie value is obscure. Eg: c5tvehik64m6tio6j43svoc7o7

My main concern would be 20 comments on a page with 2000 characters each, and whether or not it would be okay to store all of that information in a database.

Not an issue. I store images in the database that are greater than 16MB. Yes you have to wait for the information to come over. That said, I do using caching w/ the images to try and limit having to send that image on subsequent requests over the net to the user using Expires header. You can use Expires w/ any content. http://www.mnot.net/cache_docs/

On the same note, if I stored the information in text files instead, could it be easy for a hacker to change this information?

I've seen equal number files and databases hacked. Use mysql_real_escape_string() or you'll be a victim too.

This is probably bad but I pretty much ignore optimization until I find that I need it. Indexes on important fields in database tables for example is a common optimization (its a no-brainer really).

Asking mysql to do an "order by" can kill performance. This week I had the pleasure of uploading 3.8 million records then sifting through them. When I did an order by in my query the results never came back. Without the order by it took like 2 seconds to return 1200 or so rows. Do the sorting w/ php. I use uasort() a lot.