Strengthening the security of PHP using JSON

Question

Strengthening the security of PHP using JSON

I'm working on a PHP script that receives data from an Android application. What security measures should I implement to ensure the safety of this script? Are functions like isset enough?

<?php 
require ('config.php');
$connection=mysqli_connect($servername,$username,$password,$db);
$json = file_get_contents('php://input');
$obj = json_decode($json,true);
$movie_name=$obj['movie_name'];
mysqli_query($connection,"insert into  movie (movie_id, movie_name) VALUES (NULL,'$movie_name');");
echo "inserted";
?>

Any advice on securing this script would be greatly appreciated.

php android json security

Answer 1

Answer №1

After reviewing the example code provided, I have made improvements to ensure that connection and json_decode processes are checked for failures. Additionally, I included the use of prepared statements to prevent SQL injection attacks. It is advisable to add validation checks for the movie name field length in comparison with the database field size. The implementation of prepared statements should mitigate any risk of SQL injection:

<?php 
require ('config.php');

$connection=mysqli_connect($servername,$username,$password,$db);
if (!$connection) {
  // Unable to establish MySQL connection - exit with an error message
  exit();
}

$json = file_get_contents('php://input');
$obj = json_decode($json,true);

if( $obj == null ) {
  // JSON decoding failed - exit
  exit();
}

$stmt = $connection->prepare("INSERT INTO movie (movie_id, movie_name) VALUES (NULL, ?)");
$stmt->bind_param('s', $obj['movie_name']);
$stmt->execute();
$stmt->close();

echo "Record successfully inserted";

Answer 2

After reviewing the example code provided, I have made improvements to ensure that connection and json_decode processes are checked for failures. Additionally, I included the use of prepared statements to prevent SQL injection attacks. It is advisable to add validation checks for the movie name field length in comparison with the database field size. The implementation of prepared statements should mitigate any risk of SQL injection:

<?php 
require ('config.php');

$connection=mysqli_connect($servername,$username,$password,$db);
if (!$connection) {
  // Unable to establish MySQL connection - exit with an error message
  exit();
}

$json = file_get_contents('php://input');
$obj = json_decode($json,true);

if( $obj == null ) {
  // JSON decoding failed - exit
  exit();
}

$stmt = $connection->prepare("INSERT INTO movie (movie_id, movie_name) VALUES (NULL, ?)");
$stmt->bind_param('s', $obj['movie_name']);
$stmt->execute();
$stmt->close();

echo "Record successfully inserted";

Strengthening the security of PHP using JSON

Answer №1

Similar questions

Check for existing data and update it if found, otherwise insert new data in WordPress

PHP Jira OAuth: Error 401 - Unauthorized due to oauth_problem: "signature_invalid"

Displaying Form Results on the Same Page in Drupal: A Step-by-Step Guide

Tips for Sending Data in the Payload Instead of FormData

Looking for Precise Matching within JSON Using JavaScript

Transform Objects Array from AJAX Response into a Distinct JSON Entity

The response from AngularJS $resource can be considered as both an array and an object

Eliminating the occurrence of the dot character within column names in R while employing a JSON dataset

Limiting Manager user access in Laravel 5.5

Implementing a file size restriction in C# when writing a lengthy JSON string using the System.IO.Stream

Struggling to create an API endpoint in express for handling database requests... receiving a 404 error code

I've encountered the error of receiving a __PHP_Incomplete_Class Object when attempting to create a session using jQuery-ajax

Transmitting a sequence of JSON information from php to JavaScript,

The command "json_encode($array)" does not seem to be encoding the complete array

Jersey allows for easily sending both image and JSON data together in a multipart response

Reformat a JSON file and save as a new file

When a form input is submitted, the webpage will refresh with a new

The PHP blocking code in Zend Server not only blocks the response of the current ajax call but also impacts the handling

Issue with resizing keyboard/dropdown popup in Android hybrid app when navigating offscreen

What is the best way to extract a session variable from a class in PHP?