CODEWITHSUNDEEP
android
Genadinik
Genadinik

Reputation: 18639

How to connect to a MySQL database from an Android app

I came across a few tutorials online explaining how to connect to MySQL from an Android app, but they are a bit surface.

If I just write SQL and send/receive it in a POST, it seems problematic for a few reasons:

1) Hardcoding SQL with obvious issues there 2) Security concerns about sending sql - is that safe to send that request? or should it only be done via SSL? 3) To connect to the db, in order to insert things, I need to have the db connection info inside the app - is that safe? Can the code be read by someone hacking the device and the apps?

What is the best way to go about connecting and using a remote db from an Android app?

Thanks!!

Upvotes: 0

Views: 813

Answers (2)

methodin
methodin

Reputation: 6712

Wrap everything in an API and manage authentication either with encryption with public/private keys or with a token-based system. You should never, ever, ever accept raw SQL in any way, shape or form from any device or site. Most often if you need live, remote data to run you should reconsider your application workflow and work off slightly stale data or provide the information in the background due to the possible spotty connections. Hitting even an API can be a costly endeavor so it shouldn't be something that has to occur frequently.

To incorporate some of the ideas above you could a couple things. For the public/private key read up on http://en.wikipedia.org/wiki/Public-key_cryptography. The basic concept is you store the public key on the device then negotiate a private key after the installation of the application that is also stored on the device (although not coded into the application). This key is the one you have to protect so it should be negotiated on installation and stored with the lifecycle of the application. You could contact an API with a unique hash of the device (say the device ID) and a password that the user could set. In that way if the data is wiped, since the password is stored on the server you can validate that a request to generate a new key is valid for that device ID and also protect against attackers trying to disrupt everyone's keys.

Obviously this is still susceptible to someone intercepting the initial request but if you are using HTTPS (which you should) then it should mitigate most of these issues.

You have to make sure an attacker just cant send in random device ID requests to generate new keys as it would disrupt the actual user's device of that hash, which is why the password set is important. Of course they could also do this against device IDs not currently registered but you could easily implement throttling and blacklisting against the initial API.

There are many things you can do but depending on your sensitive data it may be overkill. You'll have to make that judgement call and figure out who you are trying to protect your data from.

Upvotes: 1

Dan S
Dan S

Reputation: 9189

Use a webservice through which to communicate with the database. End User clients generally do not communicate with the database over the internet. Multitier_architecture

Upvotes: 1

Related Questions