向PHP会话变量添加完整查询？

Question

I've never thought of doing this before, and am unsure of the risks. It's a one time session for each page, replaced by the next page visited.

What's the security risk of doing something like the following? If any?

$_SESSION['somename'] = "SELECT `something` FROM `table` WHERE `something`='blah'";

Is this a safe method, if not, what's a safer method to store a one time query that will be replaced?

It's probably safer to store queries within a temp mysql table. But I want to avoid additional mysql calls.

Answer 1

It is not a safe way to set variable with PHP due to the potential of exposing table names that can potentially be DROPPED via SQL injection. Now, session variables are stored on the server and can not be accessed by the browser. However, why introduce a bad habit that could cause someone less savvy on your dev team to use that to set a cookie? Then you have a large problem that started out being benign. It is better to just place data in your PHP session variables that act as a user identifier.