Android Question Mysql Security of app

[tufanv]

Hello,

I need an advice. I will describe my problem shortly.

Currently i am using httputils2 and a php on server side to make my app communicate with server. ( not able to use RDC because i have so many apps like this ) . Instead of sending the complete query as mentioned in Erel's mysql tutorial , I use pre prepared statements in my php file and send only paramters to fill them via app.

For Example for login :

sendlogin.download2("https://www.server.com/example.php", Array As String ("action", "2", "girdi6", txtu.text, "girdi7", txtp.text))

girdi 6 is txtu.text which is username textfield and girdi7 is txtp.text which is password field. I get the json result and if it is success than i proceed the user to next page and get his information.

The problem begins here. What i do is so amateur i think because after login i just show another panel and get the account info of txtu.text from the server.
1) Anybody can alter txtu.text and get another person's account info easily.
2) anybody can show the panel after login without logging in ( if he knows what to do )

So, it is clear that i am not using a correct way here.

Another problem i am having is for example with the in app purchases.When a user buys a virtual money for my game , i have to update the money remotely on my server. In purchasecomplete event of inapp v3 , I call a sub called addmoney so when the purchase is success the app calls addmoney sub. But what i experienced is people alter with the app code and directly call the sub without purchasing and the money is being added to their account.

I need to improve my methods over these 2 problems. Can you give me some ideas about it.

TY

 

[mc73]

Upon successful login, I think you should store the credentials to two variables, one for username, the other for password. Then, in the second panel, at which you're loading user info, I think you should resend these credentials in order to verify that the user who previously logged will get her own info. Finally, why don't you just return user's info upon successful login? Data returned could be passed to your second panel.

 

[tufanv]

Thanks for answer. Because the info is always changing within the game. So i need the retrieve infor for example every 30 seconds. So retrieveing the info 1 time is not possible .

Upon successful login, I think you should store the credentials to two variables, one for username, the other for password. Then, in the second panel, at which you're loading user info, I think you should resend these credentials in order to verify that the user who previously logged will get her own info. Finally, why don't you just return user's info upon successful login? Data returned could be passed to your second panel.

 

[mc73]

No Problem. So, simply store user's info and resend at every request.

 

[KMatle]

I would put more logic to the server side (because it can't be changed). You could load the panels (and/or the views) meta data after login so the app is useless as it creates the views dynamically (no layouts inside the app). Check if the balance is the same on the device and server to check any manipulations. Encrypt all the data (Random Access File on the device should be enough when the pw will be created on the server -> after login the pw will be sent to the app and with it the file can be accessed). The pw will retrieved every time online so nothing will stored inside the app.

Securing apps is all about making it hard for hackers to change the code. In this example no one wants to spend so much time to change the code.