CODEWITHSUNDEEP
phpmysqlweb-servicespost
Cam Connor
Cam Connor

Reputation: 1231

$_POST security for PHP Webservice

I apologize if this question has been asked before, if it has just link me to it in a comment.

So I've created a web-service for an android/iOS app with php that works like this.

  1. The app sends a request to http://www.example.com/ws/getCookingData.php with 2 $_POST paramaters userID and foodType

  2. The php file then queries the database using those two variables and returns a json_encode result.

My worry is that if someone were to discover my web-service link they could spam it with post requests resulting in 100's of call to my database that are just un-needed

Below is an example of my current getData.php file

<?php
$userID = mysql_escape_string($_POST['userID']);
$foodType = mysql_escape_string($_POST['foodType']);

$mysqli = getDB();

echo json_encode(getDate($mysqli, $userID, $foodType); //mysql database interaction is here

$mysqli->close();
?>

There is nothing here preventing hackers from attempting to post malicious SQL statements into my database

So what I'm wondering is if I added a 3rd parameter to my post request called appID would this be a good solution?

For example if I were to update my getData.php file to below would this be much more secure or is there a vulnerability I'm missing?

<?php
$appID = $_POST['appID'];

if($appID === "hardCodedEquivalentID"){
    $userID = mysql_escape_string($_POST['userID']);
    $foodType = mysql_escape_string($_POST['foodType']);

    $mysqli = getDB();

    echo json_encode(getDate($mysqli, $userID, $foodType); //mysql database interaction is here

    $mysqli->close();
}

?>

If this is a good solution or there is already an equivalent practice that would achieve what I'm trying to do please let me know

Upvotes: 2

Views: 66

Answers (3)

Gustek
Gustek

Reputation: 3760

To answer your first question

My worry is that if someone were to discover my web-service link they could spam it with post requests resulting in 100's of call to my database that are just un-needed

If someone wants to DoS you then you can't do much in your code to prevent it but you may try using service like cloudflare. Not worth worrying about it at the beginning.

About

There is nothing here preventing hackers from attempting to post malicious SQL statements into my database

then just read documentation on PDO

Upvotes: 2

Kinshuk Lahiri
Kinshuk Lahiri

Reputation: 1500

First of all, use mysqli or PDO instead of mysql function which is deprecated. Secondly create a function which will authenticate the user and see whether the user has the permission to access the data. And thirdly try to LIMIT the data to 100 or so if possible.

Hardcoding the appId is not the solution. Create unique Id's for each specific registered user and then match that appId against that particular user. And when their session is expired clear the access token. And at the start of their session, you can login in them and create new access token and can use the same for their entire session.

Upvotes: 2

caner taşdemir
caner taşdemir

Reputation: 203

1- Use mysql_real_escape_string()

2- Use str_replace(" ","",$_POST['userID']) and str_replace("%20","",$_POST['userID'])(Because malicious attacks involves in using %20 and space to inject sql query)

3- Add this line to the top of the page, so the script only takes request if its been from your website (That's what I am using too!)

$referrer = $_SERVER['HTTP_REFERER'];
if (strpos($referrer,"yourwebsite.com")) {
} else {
die();
}

Upvotes: -3

Related Questions