PHP session variable security

Question

Is it a bad idea to store a raw sql query in a php session variable for later use? Does this present any security issues?

Answer 1

In general, the session data is stored in a file in the server’s file system (see session.save_handler and session.save_path). If you protect that session data (e.g. by protecting the directory to be accessible only by PHP or your web server), you can put sensible data into your session.

Note that if you’re on a shared host, it’s very probably that all users on that shared host have access to that session data directory. In that case you should either change that directory to one that only you have access to or change the session save handler to store the session data in your personal database or somewhere else.