Question

Hi guys I am trying to set up a Login form in my android App.

This is how things actually work: the user enters his username and password in two EditText, this informations are sended to a PHP script through POST, the PHP scrip queries the DB and returns 1 (CORRECT USER AND PASS!) or 0 (NOT CONNECTED, INVALID USER OR PASS).

The “problem” is that now I’m doing it this way:

<?php
  /../
  if(conneted == true){
     echo 1;
  } else {
     echo 2; 
  }
?>

In my android App I obtain the HttpResponse that contains 1 or 0.

But is this safe? Using echo is the best way to obtain an answer from the script?

Thank you!
Marco

Answer 1

For something like this you may want to use the HTTP status: 200 for success and a 403 Forbidden for the NOT_CONNECTED, INVALID USER or INVALID PASS states. You can then use the body of the message for the explanation (if you care to provide an explanation: you may not want to for security reasons).

EDIT: so

header($_SERVER["SERVER_PROTOCOL"]." 403 Forbidden");

if the authentication failed and

header($_SERVER["SERVER_PROTOCOL"]." 200 OK");

if the authentication succeeded.