How to Create a secured API using PHP in xml format? - php

Question

I have an ecommerce website in which regularly transactions keeps happening. Now we are developing an android app for the same. So I was asked to build an API using PHP. The API that i made was in xml format. But now since i will be sending he login credentials through it I am scared that someone would hack it. So can someone help me with it.
here is the way i had created the xml API using php..
<?php
include 'config.php';
include 'database.php';
$sqlCat = "select category_id,image,name from table" ;
$categories = DatabaseHandler::GetAll($sqlCat);
$xml = new DomDocument("1.0","UTF-8");
$content = $xml->createElement("content");
$content = $xml->appendChild($content);
foreach($categories as $category) {
$item = $xml->createElement("item");
$catName = $xml->createElement("catName",htmlspecialchars($category['name']));
$catName = $item->appendChild($catName);
$catImage = $xml->createElement("catImage",htmlspecialchars($category['image']));
$catImage = $item->appendChild($catImage);
$sql = "select image,name,model,price,quantity from table;
$results = DatabaseHandler::GetAll($sql);
foreach($results as $key=>$result) {
$product = $xml->createElement("product");
$product->setattribute('id',$key);
$model = $xml->createElement("model",$result['model']);
$model = $product->appendChild($model);
$name = $xml->createElement("name",htmlspecialchars($result['name']));
$name = $product->appendChild($name);
$image = $xml->createElement("image",htmlspecialchars($result['image']));
$image = $product->appendChild($image);
$price = $xml->createElement("price",$result['price']);
$price = $product->appendChild($price);
$product = $item->appendChild($product);
}
$item = $content->appendChild($item);
}
$xml->FormatOutput = true;
$output = $xml->saveXML();
$xml->save("categories.xml");
?>
and I get the xml in this form..
<content>
<item>
<catName>Comp</catName>
<catImage/>
<product id="0">
<model>156443</model>
<name>CD</name>
<image>109.jpg</image>
<price>48</price>
</product>
<product id="1">
<model>46876</model>
<name>memory card</name>
<image>81.jpg</image>
<price>12</price>
</product>
<product id="2">
<model>865793</model>
<name>drive</name>
<image>51.png</image>
<price>2</price>
</product>
</item>
</content>
Can someone tell whether the way i have generated API in XML format correct.

Answer 1

Dont make think too complex make it simple like following code
$con = mysql_connect("localhost","root","root") or die("could not connect".mysql_error());
//select your database table
mysql_select_db("android_maps", $con) or die("Could not select database".mysql_error());
//get your results with a mysql query
$result = mysql_query("SELECT gmaps.*, urls.* FROM gmaps, urls WHERE urls.idgmaps = gmaps.idgmaps") or die(mysql_error());
//run a while loop get your data.
while($location = mysql_fetch_array($result)) {
$output = '<?xml version="1.0" encoding="utf-8"?>';
$output .= '<data>';
$output .= "<lat>".$location['lat']."</lat>";
$output .= "<long>.".$location['lon']."</long>";
$output .= "<description>.".$location['description']."</description>";
$output .= '</data>';
print $output;
}
mysql_close($con);
}else{
echo "<h1>No results to show for you query</h1>";
}
for more info
http://teachingyou.net/php/php-api-development-dreaming-of-your-own-api-make-it-possible-today/