Are there any security risks associated with having a writable directory within the web server's root?

In order to ease some load off the database server, I have decided to use heavy caching to cache db result sets in php files; however I must create those .php cache files automatically within a cache folder. That cache folder must be writable by the web server's user. What are the security risks here? Is this best practice? Would users be able to do things like build their own form and upload to that directory?