I am creating an application which I would like to have communicate with my website. The app will have to get data for a particular app user from the website's database. I am unclear as to the best way to do this.

I have seen one way of doing this for example is creating a login page on the app which then hits a login.php logic on my website. This is convenient because I can use one code base to handle sign in for both the website and the app.

Another solution I've seen is using JSON requests to handle the communication between app and website. This is convenient because JSON objects are easy to create and parse.

I would basically like to know the best/common way to have this communication occur, what are the pros and cons to having one over the other, and any other security issues to consider.

For example, is there a risk of exposing sensitive user data when using one method over the other? If so how can this be prevented? How and where does encryption and user validations come into play here?

  • The common way is to create an API. See the examples of APIs by Google or any other large company to have an idea of how they are done. Feb 16, 2012 at 20:25
  • There is no single 'best', 'one-size-fits-all' method. Rather than telling us the options you have seen, better define for us the specific needs for your app. I suspect when you focus on that you'll find your decision a lot easier to make. Feb 16, 2012 at 21:29
  • At the most basic level, I need a way for the mobile app to get information from my websites database. The user will have various bits of data, like different types of transactions for example. I want to be able to show my user on the app all the transaction they e done over the past month. I need to do a query on my database for that. I'm already leaning more towards PHP cause I can maintain one code base for this basic functionality. But is there a better, more secure method of doing this? Are there any obvious pitfalls/dangers I'm overlooking?
    – edc598
    Feb 16, 2012 at 22:04
  • 2
    @edc598: Please don't add comments to your question. To clarify a question, it's best to update the question to be complete and consistent.
    – S.Lott
    Feb 16, 2012 at 22:54

3 Answers 3


I would recommend building a REST API for your application and your website.

Building a web service is more work but I think it's a lot cleaner. If you do it this way, neither your website nor your application has to worry about how to connect to and query the database since all of those details will be abstracted by the API. Also, another benefit is security: if your website ever gets hacked, they won't necessarily have access to your database since the website is only making API calls (and not database calls.) Of course there are a lot of things to consider with security, but that's one less thing you have to worry about.

Here is a great starter guide on how to create a REST API in PHP:


  • Liked this answer the best since it included a helpful link. Though everyone's answer has provided a great deal of insight into the subject. Thanks!
    – edc598
    Feb 19, 2012 at 22:28
  • link is dead... Mar 7, 2017 at 11:55

Depending on the complexity of your requirements either REST/JSON or SOAP web services.

For simple requirements REST is simpler to understand and implement, especially if you favor JSON over XML.

However if your requirements include authentication, message verification, discovery, non repudiation, or, complex message schema you may be better of diving into the complexities of SOAP as nearly every issue is covered. Although SOAP is more complex and harder to understand it does deal with nearly every architectural permutation and variation possible in a messaging system, plus, it has a very mature and comprehensive set of tools to help you through the maze of APIs. But if you don't need this level of sophistication stick with REST.


The biggest disadvantage of an API is that you are putting the responsibility to make JSON requests, convert the answers, and display them on the page the responsibility of the browser. Not all browsers may be up to this, either intrinsically or because users have turned off java-script.

These concerns have been diminishing over time, however, and now affect relatively few clients. However, it might be worth doing extra work to support all the clients.

The advantages of an API are that it's much easier to separate the API logic from the details of the display and it's easier to directly access the API by means other than a browser (such as from another application). This automatically makes testing the API separate from testing the client, which is good.

It's also somewhat more secure against page injection attacks (such as cross site scripting attacks) because it's easier to properly parse and escape JSON than it is for an HTML document (which could include script tags containing java-script). This assumes that on the client you parse JSON with a JSON parser and don't just use some form of eval(), which is not at all secure.

Another possible advantage is that you can all but eliminate the "web framework" layer. Instead of ASP, JSP, Django, Zend, or whatever, you really just need a thin layer to relay JSON back and forth from your client to your server. So at minimum you could port that piece between frameworks in a trivially easy way if you wanted to. That can eliminate one big moving part from your application.

I think encryption and validation basically work the same way either way. I think if you have an API you are more likely to remember not to trust the client than if you have a web page, since it's possible to forget that attackers don't need to use a browser as a client but can send you any headers, query parameters and post data they want. This is more of a psychological than technical issue though, and might not apply to you.

  • 1
    Thank you for your answer its very well thought out. I'm looking to just support my own app tho. I thought maybe creating different methods in PHP that execute different queries for user data is a good idea. What do you think about this idea? How can I secure the communication between my PHP scripts and my app? Can I use https? Is there anything I'm overlooking? An easier method of querying this data perhaps?
    – edc598
    Feb 16, 2012 at 22:14
  • Everything I said except one thing applies to just supporting your own app. HTTPS is separate question, but it will help secure the communication but not prevent cross site scripting or attacks from your client himself. I don't really know what the last 2 question are here.
    – psr
    Feb 16, 2012 at 22:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.