[PHP and MySQL] SQL query in Session?

[oerdec]

Hi,

are there any security related problems when storing a SQL query in a session?

Why I want to do this? A user can sort or search for data records. Sometimes a lot of results were passed. So I want to write a prev/next and a pagination script.

...or is it better to store the query in the database itself?

oerdec

[Tangerine_Dream]

Why I want to do this? A user can sort or search for data records. Sometimes a lot of results were passed. So I want to write a prev/next and a pagination script.

Hi, you want to implement so different queries for every site user? Usually queries used for pagination scripts are the same at least in FROM clause and other SELECT' parts (select list, WHERE, ORDER BY, etc clauses) can be simply composed from user options (stored in cookies or profile), so there's no need to store/remember queries itself. If you talking about result set returned by query (e.g stored in PHP array), then you may want to store it in session variables (e.g to implement data "caching" to improve site performance), but only if data can't be changed because, otherwise users will be viewing incomplete/obsolete data. I don't see any security risks, but you web server may require some additional resources to store result sets in session variables. Hope this helps