Mysql database reading and writing [closed]

Question

In my Libgdx application I would like to be able to connect to a mysql server securely and read and write data from it without other users injecting, or changing information. I've found this: http://www.helloandroid.com/tutorials/connecting-mysql-database but its only for reading what about writing data without people messing with it with other apps? I need a form of unique verification.

Answer 1

Don't follow the guidance of Ion Farima. This is plain wrong and not secure.

The correct way of handling this is via a webservice (REST, SOAP, protobuff, whatever suits your needs). Your app/game connects with the webservice, sending the required data (+ using salted MD5/SHA1 hash of the data with other stuff required to identify the user (i.e. unique user id you create when the app is first started)) to the webservice.

The Webservice validates the data and does the read/write operations. This way, your Database credentials are never inside your app, only in your webservice and via webservice you can controll which data is read or written, i.e. limiting a certain request to only be able certain data (of the user calling it for example).

If you use credentials in your app, this makes it vulnerable that someone will phish that credentials out and directly connect to your database, having full access of your apps user (i.e. reading/modifiing/deleting all tables that mysql user has access too).

edit: The only situation when an App should connect to an Database Server directly and send credentials is, when your App is an Database Client App (like HeidiSQL) and where the user enters his own credentials to manage his own Database server