I’ve recently come across a website project where the client wants me to dynamically serve up about 200 text snippets (paragraphs) depending on which ones are requested. He’s running a fairly simple business and doesn’t have any database back-end support with his provider.
Are there any blatant reasons (other than speed) why I couldn’t just put each of these paragraphs into a text file and serve them from there using a php script? I’ve done this in the past and it works fine; I’m mostly wondering if there are any obscure security considerations I might not be thinking about.
The usual security considerations for file upload apply: with careless server settings, an attacker can place javascript or php code in those files and trick the server or your browser into executing them (or, if your setup really sucks, read or write system files). Other than that, I don’t see security problems (though there are a lot of non-security-related advantages to a database: concurrency handling, better search, sane metadata handling, easier to extend later).