在iOS-> php-> mySQL之间安全地传输数据

Question

Basically I have the iOS app that sends a POST request to a php file on my website containing its location, and then the php file connects/sends that to the mySQL database, and vice-versa. Everything works fine, etc. but what I really want is a way to make sure nobody can make some bogus script sending a POST request to my php file, and infiltrating the database.

My first thought was to have some sort of "key" that would also be sent to check if it matches the one in the php file. I could have it be something like this https://www.grc.com/passwords.htm . Anyways, I worry that this isn't as secure (or efficient) as I might want. The person reviewing my code for acceptance into the App Store would see it, right?

Sorry if this is a stupid question, but what is the best way to ensure only I can send/receive data from the mySQL database (and thus the PHP file)?

Thanks!

Answer 1

Jajaja "Sorry if this is a stupid question". There is never a stupid question, unless you do not have the desire to learn.

I also had a question like, and it's true that you want to secure the data that you manipulate because it is very important. You have to see both client side and server.

For example, in the client side:

1) Are you sending data to the server so that this may not be legible?

2) Are you using https?

Or in server:

1) Are you server is capable of recognizing when data arrives it reliable?

2) Do you use any algorithm encrypt for your data? client encrypt and server descrypt or viceversa?

Not always because they use a key, will be always safe. I hope that works for you and apologize for my English :)

Answer 2

• Send it over SSL

• Implement SSL Pinning in your app

• Optionally hash all or parts of your data/query parameters, etc with a salt and pass this hash along with the rest. On the server hash/salt the parameters/data etc and verify the salt matches. They would have to bypass ssl, your pinning, and then RE your app to extract the approach you took to applying your salt as well as the salt itself. example here

• As for the php/server side you would want to sanitize anything going to mysql. Example

This is a "start".

Answer 3

The crux of the question seems to be: "infiltrating the database".

Avoiding this is accomplished by never issuing user created commands to the db. Intercept all user requests, parse, validate and extract the information. If all is good your code makes a request to the db with sanitized parameters.

SSL will protect the data in transit. You also need to protect against an attacker that creates an attack request.