Re: Best practices for persisting (serializing) ACLs

Hi Josh,

I'm not sure that serializing an ACL object and storing it in the
database is "best practice" for all situations. Best practices must be
considered in light of the particular situations to which they are meant
to apply. Put another way, what is best practice for your situation is
likely different than what would be best practice for another's situation.

If you have a MySQL database to which you're connecting anyway in your
PHP script, it should be very inexpensive to fetch the serialized ACL
from the database. That said, it may also be very inexpensive to load it
from a file or cache server, too.

I'm not sure about XML serialization of an ACL object, but I'd be
interested to hear more about it, especially if people have had some
success with it.

At the end of the day, it may not matter at all from a performance
standpoint where you store the serialized ACL object, particularly if
your application makes heavy use of an RDBMS or depends on web services
availability, for example.

Are there other more specific aspects of ACL storage you wish to
address? At this high-level of discussion it is difficult for me to
provide clear and helpful answers.

Best regards,
Darby

Joshua Beall wrote:
> Hello All,
> 
> It looks like the simplest way to persist ACL data is to serialize it, and
> store the string in a database.
> 
> Is that considered the "best practice"?  It talks about this in the ZF
> documentation, so I'm guessing it is...?
> 
> Also, I was wondering if others have had success using XML serializers
> written in PHP to persist ACL information?  I see there's a PEAR module, but
> it's latest release was in 2005.
> http://pear.php.net/package/XML_Serializer/redirected
> 
> Then of course there's the WDDX extension, but that's a PHP extension, not a
> native PHP implementation of XML serialization.
> 
>   -Josh