php - how to connect users with mysql in mobile apps? Login permissions

Solution:

First, don't store credit cards in your own database. Use something like stripe to tokenize the data (Free to sign up and anyone gets accepted).

If you are doing a mobile app with your own usernames and password, a remote server with usernames / passwords is the way to go. Hashing is usually a better approach for passwords than encrypting, since hashes are one way (you can know if a password matches, but you can never retrieve the password as a string).

As for connecting to your database, don't connect to it directly. Do it through an api / web service on your server.

For getting info from the server, you'll probably want to use json and use GET and POST requests. Here's a simple example for handling a login request on the server (make a post from the device):

<?php

if(isset($_POST['username']) && isset($_POST['password']))
{
  //See if the user's auth details are valid
  $auth = auth_model::try_auth(sanitizer($_POST['username']), sanitizer($_POST['password']));

  //If valid
  if($auth)
  {
    echo json_encode(other_model::some_function_that_returns_array());
    exit;
  }
  else
  {
    echo json_encode(array('error' => 'Authentication failed.'));
    exit;
  }
}
Copy code

Note that I totally made up auth_model, sanitizer, and other_model, they are just there for example.

Most languages / platforms have libraries for consuming json, and it's a simple format, so as a starting point I think you'll have the easiest time with it.

For sessions / state, store your session in a database table and return just the id (and anything else that doesn't really need to be secure) to the client.

Solution:

You shouldn't use a direct connection to your MySQL server from the app - it's a huge security gap. Users or hackers could either just sniff the traffic for credentials or disassemble the app to get them. Instead, do it server side via PHP and https-secured HTTP POST and GET of course.

You could add a user for every user of your app in your MySQL server automatically, but that would probably be way more complex.