Save to session - Does a cache mean the back end code doesn't always run?

Question

Hello SO,

So for a bit of background, I am creating a website with the Zend Framework. There is a page where I am using AJAX to save a rating to my database. I obvious need the key for the store in order to know what store the rating is to be saved for.

In order to access the store for the page, the URL is MYSTORE.com/stores/2. The 2 is the store key, so it could be 13, 10, whatever. What my PHP script currently does is when it loads the page, it stores the store_id as a session. Then if they rate the store (all in JS), it will snag the store_id value from session, and combine them to send an insert to my database. So here's my problem.

Somewhere down the line, I'll probably want to cache to save my server some trouble. I have never used one before, and am worried that instead of running the script that saves the store_id to session, the page loads from the cache and never stores store_id. This would mean that the review could theoretically be saved to the wrong store. Is this a reasonable worry, and is there a way around this?

My other question is if there was maybe a better way to do it. I'm hesitant to place the store id into the JS or HTML since (at least I think) you can mess with the scripts through Firebug, or other web tools. I'd like my page to be secure. Is there a better way to do this?

I hope my question makes sense, and thank you in advance.

-Ethan

Answer 1

My advice is don't solve a problem until you have a problem. When they load the page just put the movie ID in the URL, possibly with some sort of checksum or hash so someone can't just blanket upvote and downvote every ID.

There's no need to store this in the session. Just keep it in the database until you need to change it. Don't forget that sessions are file-based. Using them for performance gains is a little misguided. Just use them where appropriate.

Knuth said "premature optimization is the root of all evil" and that's what this looks like to me. You're right in that you greatly complicate your code by keeping an ID in the session and that can get out of sync with what the user is seeing (eg using the back button). Stick the ID in the Webpage and that problem is solved.