Android Question POST to MySQL

[Salimalhajri]

Hello

I Looking a lot in the Forum for a way to send data to the database MYSQL but I can not find the way or I did not understand some of the optimal asked nearby

I know the way to the transmitter by $_GET but limited to send texts of no more than 270 characters

I want a simple example in the use $_POST
And also the code that is sent to the database in the PHP file

Sorry translation
Google Translate

Thank you very much

 

[edgar_ortiz]

The easy way is using a Web-Service.

Check:
http://www.b4x.com/android/forum/threads/connect-android-to-mysql-database-tutorial.8339/#content



Regards,

Edgar

 

[Salimalhajri]

edgar_ortiz Thanks for your help

But I want to send a long text
This is the code that I wrote to function ( $_GET ) and works well, but does not send the text larger than 270 characters

job1.Initialize("Send",Me)
      job1.Download2("http://mysite/send.php",Array As String("comment_txt",Etext.Text))

<?php
include("config.php");
$comment_txt= trim($_GET["comment_txt"]);
    $query = "INSERT INTO Comments( comment_txt )values ( '$comment_txt')";
    $insert_the_data = mysql_query($query)or die(mysql_error());

?>

Thanks

 

[nwhitfield]

You use the PostString function in your B4A code. For instance, this is how my app would send a message to another user

Dim callName, apiOpts As String

callName = "message"
apiOpts = "ACTION=message&AUTH=3785bcf34&ID=3&TEXT=This is a message from one user to the user with id 3 - obviously the apiOpts string is normally built in code"

apiCall.Initialize(callName,BLUFservice)
apiCall.PostString(apiURL,apiOpts)
apiCall.GetRequest.SetHeader("User-Agent",blufVersion)

Then in the PHP, I check the authorisation info, which gives me the calling member id (you can see a bit of an example of that in the code I posted at http://www.b4x.com/android/forum/th...-php-script-is-called-from.42368/#post-256219 )

To put the message in the database, I would do something like this (I'm using the mysqli functions in PHP; always remember to clean your strings, kids!))

if ( $_POST['ACTION'] == 'message' ) {
  $msgQ = $blufDB->query(sprintf("INSERT INTO messages ( sender, recipient, content, created ) VALUES ( %d, %d, '%s', NOW())",$auth['memberid'],$_POST['ID'],$blufDB->real_escape_string($_POST['TEXT']))) ;
}

 

[nwhitfield]

Also, to expand on my comment about cleaning strings, you absolutely must do this. In the example in post #3, what happens if someone supplies the comment text hello');DROP DATABASE

Potentially, Very Bad Things Indeed. It's a classic SQL injection attempt - and never assume that your users will be innocent of malice, let alone anyone else who's simply scanning sites for backdoors, whether they want to break your site, or simply see if they can get names and passwords, or email addresses to spam.

If you're using PHP as a backend, I strongly advise using the newer MySQLi commands. It provides better protection against mysql injection, and the real_escape_string should be mandatory pretty much wherever you are putting values into a database.

Using sprintf to help construct your query can help too, as it ensures that numeric values are just that - if someone had fiddled the $_POST['ID'] parameter in the example I gave, and sent a string, since it's using %d in the sprintf, it would simply evaluate to zero, which is why I don't bother using real_escape_string - though elsewhere in my code, I usually do a check for is_numeric($_POST['ID']) as well.

If you can avoid it (which you obviously can't with things like messaging) don't put text from a user anywhere near your database; use numeric parameters.

If you have to accept text from a user, sanitise it first, with real_escape_string.

If it can only be one of a range of values, use if or select statements to make sure it really will be one of those, for example, for a checkbox you might say

if ( $_POST['opt-in'] == 'y' ) {
  $optin = 'y' ;
} else {
  $optin = 'n' ;
}

and then use the value of $optin in your SQL statement, instead of the value posted by the user.

You should probably also consider whether or not your script should have a separate database user, with different permissions. For example, I have a public API script that allows people to fetch calendar events from my site. That runs with a specific user that has permissions set in MySQL that allow only SELECT statements from the tables related to the calendar.

The main API script requires INSERT permissions in some tables, but not others, so it's a good idea to restrict that as well.

Most of this, of course, also applies to other server-side technologies - if in doubt, assume that what's being sent to your database server could potentially be malicious, and make sure you do everything possible to stop bad things happening.

 

[Salimalhajri]

Thank you very much nwhitfield for your help

I'm trying to do u way

Question

What type of ( apiCall ) library used ?

Is HttpUtils2 v2.01 or the other !

 

[nwhitfield]

Doh! I forgot the obvious

Dim apiCall as HttpJob

I use httputils2 in b4a, because it's built in and does the work in the background.

I've actually created a code module (called BLUF) that handles my website's API, creating the appropriate URLs and despatching them using http2utils, together with a service module that processes the data returned. Both should be usable in other apps - for example if I do a tablet version - and the code module will probably need little or no changes for B4i when that is released.

Then in the main module, I don't have to worry about any of the API details anymore; I can just say things like

BLUF.message(recipient,messageText)

If I decided, for whatever reason, to use an alternative to HttpJob - perhaps to do synchronous calls - then I could write an alternative code module that provides the same functions, and not have to change anything in the rest of the app.