Android Question Advice needed, Remote SQL services and security questions

[jmon]

Hi everyone,

The application I am starting to develop requires a user interaction with a Database.

Basically, users should be able to download comments and ratings from an online database, and submit their own comments and ratings too.

I have a good experience of MySQL and SQLite, mostly with the applications I developed for my company. But the experience I have, the users were connecting directly to a remote DB on a trusted computer in the company, by LAN. The login and password were hard-coded in the application. The security wasn't an issue, the transactions were not encrypted. I knew everyone in the company.

I have read some about what I want to do, but many examples involve languages that I don't know, such as PHP and Json.

As I have never worked with remote internet databases and unknown users, I have a few questions:

1. Should I proceed the same way as I have done previously, with prepared statements, pools and sq.ExecuteQuery2 to query and write the Database?
2. What hosted database services would you recommend?
3. What would be the secure way to avoid storing the password and login in the APK file?
4. Can all of that be done with only B4J and B4A, or do I need to learn PHP or something else?
5. Is there anything else that I could be missing and should be aware of?

Thank you.
Jmon.

 

[Erel]

You don't need to know PHP or to use PHP. Have you seen RDC?

You can also implement the back end with B4J.

What would be the secure way to avoid storing the password and login in the APK file?

You can let the user enter his password.

 

[KMatle]

Since hosters are very cheap I went from the (very nice) remote calls to a combination of httputils, php and MySQL.

My reasons were:

1. I don't want to have a server at home (and monitor it)
2. The prices for a hosted php & MySQL are very low
3. php & MySQL with httputils2 is very simple
4. I wanted a user registration & a maximum of security (each user has to log in with an own password - the database password will never be transmitted)

So take a look at my examples if you like.

http://www.b4x.com/android/forum/th...h-a-server-using-httputils2-part-1-php.42442/

http://www.b4x.com/android/forum/th...a-server-using-httputils2-part-2-mysql.42456/

http://www.b4x.com/android/forum/th...using-httputils2-part-3-php-mysql-json.42663/

http://www.b4x.com/android/forum/th...on-using-httputils2-php-mysql-and-mail.42745/

 

[jmon]

Thanks a lot both of you.

Klaus, those examples you wrote are exactly what I needed. They answer all my questions, especially the one on how to store the database password and how to send data to the database. Your examples are very easy to understand. Thanks for spending time writing them.

[edit]
Would you have a recommendation on which online SQL services to go for? So far I am hesitating between Google SQL and Rackspace, but maybe some other choices would be better?

Thanks again.

 

[KMatle]

Im at 1&1 Germany. I would get a "cheap" or free one first (to see how far you get with your app). Later on you can switch to a more poweful hosting solution.

One thing I am thinking about is the load of users. I didn't find a source where you can get any informations like "x users with x data = x servers". Imagine you app will be downloaded 100K times. Then you probably have to spend a lot of money to get more servers (or a dynamic solution).

 

[jmon]

@Erel

Have you seen RDC?

My question may seem stupid, but do you mean Remote Desktop Connection?

You can let the user enter his password.

Sorry, I missexplained, I was meaning the login and password for the database. But what Klaus explain in his examples is what I needed. Only the script on the server knows the password and login and users don't need to execute and query directly the database.

@Klaus Matle

Imagine you app will be downloaded 100K times.

That's the kind of figure I'm looking at, at most. I think there could be around 1000 to 10k active users per day, but who knows, it could be more or less.

Im at 1&1 Germany. I would get a "cheap" or free one first.

Good idea, I'll try at least to find a free one while I do my beta and a paid one later when I go live.

Thanks all of you for your help! It's most appreciated.

[edit]
So I went for "000webhost.com", at least for the beta version, maybe later I'll go for something more pro like dreamhost.

 

[KMatle]

RDC = Remote Database Connector

http://www.b4x.com/android/forum/threads/remote-database-connector-connect-to-any-remote-db.31540/

You can connect to any (not local) database. Nice solution, but I'm worriing about the db user&password stored in a config file. On rooted devices it's very easy to read it (big trouble).

 

[jmon]

Nice solution, but I'm worriing about the db user&password stored in a config file. On rooted devices it's very easy to read it (big trouble).

Thanks,

I'm worried about that too, so your solution with PHP seem simple enough and easy to implement.

 

[KMatle]

Yep. It's very easy and there are so many examples (php & mysql) in the net.

 

[incendio]

RDC = Remote Database Connector

http://www.b4x.com/android/forum/threads/remote-database-connector-connect-to-any-remote-db.31540/

You can connect to any (not local) database. Nice solution, but I'm worriing about the db user&password stored in a config file. On rooted devices it's very easy to read it (big trouble).

As I know, RDC's config file store on server, not on device, how could it read from rooted device?