PHP API Protection? - php

Question

I have a simple PHP API. I just used cURL for the Client and $_POST to accept the requests at the Server side. Something like ..
Client:
<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "http://www.example.com/api-server");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, array('q' => 'world!'));
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER , 1);
$response = curl_exec($ch);
curl_close($ch);
echo json_decode($response);
?>
Server:
<?php
echo json_encode("hello, ".$_POST["q"]);
?>
My questions here are:
Am i even still following the standard API logic anyway?
How to "PROTECT" this API Server Access?

Answer 1

Okay i found it here for what i asked above:
http://php.net/manual/en/features.http-auth.php
It simply used, for API page:
if ( $_SERVER['PHP_AUTH_USER'] == $MY_API_USER && $_SERVER['PHP_AUTH_PW'] == $MY_API_PW) {
..
..
} else {
header('WWW-Authenticate: Basic realm="Sorry, this API is protected. You may need a valid authentication."');
header('HTTP/1.0 401 Unauthorized');
exit;
}
At the Caller/requester end, add this two lines into the cURL calls:
..
curl_setopt($ch, CURLOPT_USERPWD, $MY_API_USER.":".$MY_API_PWD);
curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
..
Thats simply all, for me.

Answer 2

Dont try & write an API engine, these are industry standard. Look at Soap or REST.
Here are some of the libraries out there that will do all the heavy lifting:
Soap server http://framework.zend.com/manual/2.0/en/modules/zend.soap.server.html
Soap client http://framework.zend.com/manual/2.0/en/modules/zend.soap.client.html
Rest server
Rest client
Then to protect these you could use basic http protection, through to OAuth etc

Answer 3

While there are well defined communication protocols such as HTTP, and transport formats such as JSON, the actual implementation of a API architecture is left to the developer.
Many existing tools, from complete frameworks to modular components, exist to assist in the construction of an API layer, but at the end of the day you need to build something that works.
If you need a server, focus on the server, and focus on an implementation that adheres to standards when available, and best practices otherwise; including facets such as resource architecture, authentication, and so forth.
Right now, you're spewing out some query parameter concatenated JSON. I doubt that's the intended final result, unless you're after an echo server.
Model your API after a service, or domain model; expose methods and properties as resources of your API layer.
Addendum: Oh, and as for "protection"; the already mentioned techniques of HTTP Basic or OAuth are good candidates, but as is the core of my answer: it depends on what you need.