database security with php page that spits out XML

I just created a PHP page that spits outs some data from my database in an XML format. This data is fetched from a flex application I made.

I had spent a long time formatting my tables and database information and do not want anyone to be able to simply type www.mysite.com/page_that_spits_out_XML.php and steal my data. However, at the same time I need to be able to access this page开发者_Python百科 from my flex application.

Is there a way I can prevent other people from doing this? Thank you!

---

Are you using Flex's HTTPService object?

A few general ideas...

• Create a Session or Cookie authentication scheme on your web service

• Add some type of API key that Flex passes to your XML web service, which would provide a basic safeguard (though it can easily be detected and doesn't provide much in terms of security as it's visible in the postdata).

• Use something like HTTP basic authentication: http://geekzguru.wordpress.com/2008/07/04/howto-add-basic-authentication-header-to-httpservice/

---

You need to set up an authentication. The Flex application sends HTTP POST data (typically a username and a password) to the server where your PHP application checks whether the account exists and if it does, it sets up a session. Whenever accessing a file (such as the page_that_outputs_xml.php), the PHP file will check whether the account in the session has a permission to view this data.

That would be as bulletproof as today's most login systems.

---

The only thing that is really going to slow down a datathief is encryption, make sure that your flex app is obfuscated and that the key and the encryption function stored within is neither guessable nor easily extractable.

This is the best you can do, but it's not a type of solution I would generally recommend. If someone REALLY want that data they are going to get it.

---

Get your flex app to send a secret key (hash or something) and then get your PHP to check if who is accessing it has a correct key. Might want to use a POST request to hide what you are sending. This isn't super secure but that's my two cents!