Question

I’m building an Android application which has to sent some information to my mysql database. The mechanism I’m trying to implement is based on JSON, php, Mysql combination. Unfortunately I’m not a veteran when it comes for those subjects. As I understand correctly the php-Mysql connection is always secure – nobody except me can see the source of php script in which I have written username and password to my database. Now the tricky part, my php script is located on Apache server and it isn’t protected at all, therefore anybody can trigger it (even from the desktop browser). How can I prevent this situation? and how can I safetly trigger my php script from my Android device?
Thanks

Answer 1

1. Use ssl, this will encrypt the connection
2. Set an authenticate mechanism, on your php page and you android application will send the credentials
3. Set a random pin code that the server side sends to the application, and he is valid only to the current session, and the application need to run a function that will generate the right answer to this current number and sends it to the server as verification, for example if the server sends me the pin number:120, and the verification function of mine is to +1 the pin number I will send the server 121, but I suggest to use a little bit more complicated algorithm.