Android: Handle PHP response from HTTP post

Question

I am trying to understand how to deal with the response I'm getting from a PHP login page from a HTTP post. Rather than make this question 3 pages long I posted links to both files you will need to see. They are both each about 100 lines of code.

---> java <--- code that handles the HTTP post and response

---> php <--- code that validates a username/password

Now the problem. When I enter an invalid username/password I get this response

05-21 17:59:38.012: V/RESPONSE(24420):
        <script>window.location.href="index.php?err_msg=1";</script>
        <!--<script>window.location.href="index.php?err_msg=1";</script>-->
        <!-- <meta http-equiv="refresh" content="0;url=index.php?err_msg=1">-->    

When the values are valid I get this response

05-21 17:56:54.892: V/RESPONSE(24420):              
    <script>window.location.href="welcome.php";</script>          
    <!--  <meta http-equiv="refresh" content="0;url=welcome.php">   -->
    !--<script>window.location.href="index.php?err_msg=1";</script>-->  
    <!-- <meta http-equiv="refresh" content="0;url=index.php?err_msg=1">-->    

If you look at the PHP file it's easy enough to see where this is coming from. I just don't know how to deal with it. Most sites I've done this with respond with "True", "1", "Success" or something else very generic for a successful or unsuccessful login. How do I handle this response? I could obviously copy paste the entire response in an if else statement but that seems like the wrong thing to do.

So, question: Has anyone seen this before and what do I do with this type of response? Alternatively, should I just create a web service to handle this login rather than use the default PHP the website developer created?

Answer 1

It looks like the PHP code is not intended to be used by mobile clients and its expecting its "clients" to be web browsers. Hence the use of cookies & sessions. If it were written with the perspective of providing an API then it would use authentication via HTTP headers and probably some kind of token exchange.

I think this PHP will be complicated to work with. Any way you can get the PHP to be adjusted with a more API workflow?