Question

I have a cache library that stores cached data in normal php files, with the data stored in arrays.

An example of a cache file:

cache_userID.php:

$userCache['userID']=2354654654;
$userCache['userName']=foo;
$userCache['userPass']=salted-and-hashed-pass;

It works like a charm. So I’m thinking of using it to store user data (like the above example) to save DB querying. I’ve already tested it, and it does result in a noticeably faster page load time then fetching from the DB (which is why I want to do it).

I’m not sure if this is really safe though. The password and other sensitive information is salted and hashed. Would it be possible for anyone to be able to steal this data? With the exception of if they had the FTP details to access the source code (which won’t be the case).

Answer 1

As long as the file contains <?php the data will be safe as users cannot see PHP sourcecode unless they have FTP access or there is a security hole allowing them to read arbitrary files.

However, you should protect your cache folder either by moving it outside the document root or blocking any http access to it via the webserver config (e.g. a deny from all in your .htaccess) anyway.