I have my website(in php) running in Yahoo small business and Application(in java) in Rackspace.com.both server has got mysql database.
I want to query my application database(in rackspace) from my website(in Yahoo) and get the result set.
How to do it?
Please suggest me reference document to do it.
Is it a good idea to directly query a remote database ? means is there any performance issue will rise ?
It's always a bad idea to remotely access data that do not "belong" to your app. In this case, the PHP app should access a set of functions that are exposed on the Java side. This is to make sure that when you upgrade the Java side, you may change the schema of the database without affecting anyone interacting with it.
I recommend you look into Web Services -- there are many methods (eg look for RPC, REST, SOAP), and some might be a better fit for your needs than others.
If you open the database port, it should be easy but unsecure.
If you can access the database port in a secure manner (for example vpn tunnel), it would be easy and secure :)
My suggestion would be to implement the querys as SOAP Services in the Application and access them via PHP. Google should provide enough Results about SOAP in both languages.
AFAIK
if you would like to use the java function from php you should implement the web services in java in any of the web service types
You can access web services from php using the cURL calls
Related
I am creating 3 applications that are written for different platforms (.NET (C#), Android (Java) and PHP). I'm using C# for the WPF application that is going to run on Windows PCs, PHP on the server side and Java for the mobile app. I am using a MySQL database where I'm storing all the information that 3 apps are going to be using.
I am using web requests to my Apache server (JSON and POST basically) when I need some specific stuff to do with PHP.
But, how safe is:
When I'm connecting to the MySQL database via C# and Java?
When I'm sending GET and POST web requests with C# and Java?
Can you somehow spy on the traffic that is going on between the device (PC / Android device) and the server and find out the user and the password of the database, or even get the post request parameters that the app is sending?
Because I know there are a lot of network-monitoring software and I wouldn't be surprised if this is possible.
If it is, then how to avoid it?
"How secure are Java and C#?" isn't quite the right question, because the answer depends on what you do rather than the features in the languages. They both have plenty of good options for implementing various types of security in various ways. What really matters in your case is how the machines communicate.
Can you somehow spy on the traffic that is going on between the device (PC / Android device) and the server and find out the user and the password of the database
Your clients (the PCs and Android devices) should not be connecting directly to your database. They should submit requests to your server, where you have much more control, and can authenticate clients and validate their data. The server then connects to the DB.
If the clients call the DB directly, not only are the credentials transmitted over the internet, but they must also be present locally on the client in some form. This means that someone could potentially crack your app and get access to them.
or even get the post request parameters that the app is sending?
Yes, these can be intercepted and read. Again, preventing this is a matter of how you implement the communication. Use the HTTPS protocol, which you can do in both C# and Java, and the content of your requests will be protected from being intercepted by third parties along the way.
When your traffic is noticed or intercepted it will be freely interpretatable to the reader. You can see an example of such traffic in the console window of your browser, or if you want to view the actual application traffic use a proxy (such as Fiddler2).
If you want to prevent your traffic from being read, you have to take measures to ensure authorization and access control. You can do this by encrypting the traffic with TLS/SSL. If you have web-endpoints you can often enable https trough the libraries configuration. You may need to pass it as a parameter to the code that builds your connection.
Furthermore, it is best practice not to divulge sensitive information in your application output. You will want to use strong passwords and refrain from storing or sending these in plaintext.
I would also advice you to break down the need for securing in smaller bits.
Example:
You are using a lot of different technologies. These all have best practices and guidelines related to security. Separate your applications from your networking/operational assets. Encrypting your communication is a measure in your application. Whereas your MySQL configuration works in a different way entirely, mostly trough configuration.
Why are you connecting directly to your DB from the Android/WPF apps?
If the MySQL DB is sitting on a secure server, perhaps wrap the database calls/services in RESTful APIs implemented in your PHP solution, then call the APIs from your client apps, this also saves you from writing SQL statements and DB specific tasks in multiple languages (Java/C#)
not knowing your situation makes it hard though...
I have a website that I'm wanting to create a Java application for, and while I don't have any experience creating android applications I have a decent amount of Java experience and feel like I should be able to complete this task over some time. I'll be making use of the Java.IO package for client-side networking (On the application) and hosting a server using Java. This server application will have access to all of the same databases as the website through JDBC. (I'll be hosting it all on the same server.)
My question is how to go about handling connections on the android platform, currently I verify a dynamically generated salt with the database salt on every page refresh to prevent session theft. I also make sure that the encrypted password and the user-name stored in the session match.
I could theoretically just create a standard server application, using NIO and avoding the whole thread-per-client scenario. The problem is that my website has quite a bit of traffic, and I know the application will too. So I'm running into issues on how to handle it.
If I use a keep-alive TCP connection and store the users basic information in a class data structure (Psuedo example):
class User {
int id;
}
Considering all information will be polled from a database and everything is relative to the id of an account, there's no reason to store any excess data into the User class, correct? Just a quick simple lookup tied to the connection to only get data relavent to yourself.
Should I avoid the use of TCP networking for this? What do you guys think.
On the server side, create REST web services that invoke CRUD operations on the server database, and return the responses to the client as a JSONObject or JSONArray. Android has internal support for JSON parsing, and you can use the Volley library to call the web services. Volley is a pretty abstract, high-level HTTP library that makes it very easy to make REST web service calls. TCP connections are quite low-level and are not generally used in client-server Android apps. See the Transmitting Network Data tutorial for more on this.
Currently i have a website offering some product. The webserver sits on the same system as the database and directly accesses it to retrieve the required information for the HTML frontend. Now i think it is good to separate the database from the webserver via an API server. The reason why i want to use an API server is that it might be possible that future applications, other than the website, will need access to the information on the system.
The system which i want should consist of the following components:
A database which will store all the required information.
An API server which will be implemented in Java and should use oauth2 for authorizing user requests. The API server will have the only direct connection to the database.
A webserver.
So basically what i have in mind is that i want to build my website on top of that API server. The user will register/login/... over the website and the website implementation will internally query the API server as a webservice on behalf of the user. The API server would then return the data from the database. That way the HTML frontend is just an application using the API server and will never itself be in direct contact with the database.
I think that this is an often encountered problem for which a good solution exists. I am unsure if this solution is the way to go though. Could you help me out and/or point me in the right direction from here?
Thank you.
As far as I know, it is not advisable to have a separate API server for a couple of reasons: decreasing performance and increasing compexity of a system. So basically you should avoid this type of solution for as long as possible.
You should definitely read M. Fowler: "Enterprise Architecture Patterns" for inspiration.
Returning to your question: have you considered making this API layer as a module (library)?
If I haven't convinced you, try reading Java RMI documentation (http://www.oracle.com/technetwork/java/javase/tech/index-jsp-136424.html)
I am learning to program Java. My objective is to create client server application based on Java and MySQL.
That would have following.
Server Application where all admin controls would be available to configure.
server application will be the only to have access rights to MySQL.
Server will have all functions and objects that clients will require and call and get that functionality. (Reason for that is "I don't want to share MySQL credentials to client apps or rather i don't want MySQL credentials to be transmitted on the network to clients"). As it would increase maintenance tough and it could be a security loop hole.
An analogy of functionality could be: client calls to server telling to add an Order such addOrder(order_id, payment,..,...,..) and so on.
What are the method in practice for such kind of application these days? A example code/or material to get in right direction would suffice
These days the universal way to expose a service remotely is via a web service. This solution was preferred by the industry over time due to its simplicity and ease of integration to the point that binary based protocols like CORBA are now seldom used.
Take the example of Android applications, they are native application mostly using REST web services.
A REST web service can be easilly integrated in the same way with a desktop application, a mobile application or a web application, even if the clients are written in different native platforms and languages.
As sample code, have a look at tutorials on the Spring stack. For the server see this tutorial for building an hello word REST web service. For the client, consider the REST template.
For security, see this Spring security hello world example. Using the Spring stack in Java will likelly give you the largest number of tutorials and online support.
This sounds like a good place to use RMI, which Java has built in support for. RMI will allow your client to call server-side methods on a local object that corresponds to the server, where all messages/commands get transparently sent to the actual server, where you have your DB access stuff and logic.
I'm using GWT for a web-app and I need to access to a mySql-database. There will be only one client (The app is used on a iPad localy). Is there any way to access the database without RPC? I'm looking for a possibility to direkty query a database.
Thanks!
There are 2.5 reasons you cannot use gwt to directly access MySQL.
Reason #1.
GWT is compiled into Javascript. You need to open a socket to the database server. GWT does not allow you to open a socket. In fact, no unaugmented browser (before advent of html5) is able to open a socket. But you can open a socket using Flash actionscript, or HTML 5 javascript.
Reason #2.
OK, let's say you used HTML5 sockets. And you spent 6 months writing in Javascript a JDBC connectivity. But, your websocket would still need to address a servlet on the server which would help your websocket establish a persistent connection - and mysql is unable to perform such an establishment.
Reason #3.
SLD - SOP restriction:
(Second Level Domain Same Origin Policy)
Standard browser restricts its pages to only be able to request for, and to include, content from within the same second-level domain (SLD) as the server that provided that page to the browser. Top level domains (and top-level and a half) are such as .com, .org, .net, .me.us or .co.uk. So, domain names such as google.com, fbi.gov, mit.edu are second level domains. While, mail.google.com would be a third-level domain. Therefore, GWT would work only within the confines of an SLD. Your web server must also be accessible at the same SLD as your mysql server.
SLD-SOP and tunneling requirement is to close a security hole that could have allowed any tom-rick-or-mary to log into your system thro your browser. Tunneling is always required for a browser to connect to a server other than a http server. Tunneling is when a browser exploits the web server as a yenta (yiddish for busy-body/go-between/match-maker) to get to another server.
You have no choice but to use GWT-RPC. Perhaps you don't wish to use RPC, then you could use RequestBuilder, or Script-Include or RequestFactory. But they are all still diverse means of tunneling. http://h2g2java.blessedgeek.com/2011/06/gwt-requestbuilder-vs-rpc-vs-script.html.
There is one reason why you can connect to your database server from your gwt client:
Your database server must run httpd connection engine. That is, your gwt app would access the db server thro http. I am not familiar with which relational database has a http access available. Most probably, you would have to query thro xml or json.
However, a company I had worked for created our own http service to allow "direct" client access. "direct" is a misnomer because we used tomcat. It is stil tunneling. Any database company that offers "direct" http access is still tunneling. Tunneling - no escape from it.
You could augment the browser with Flash and write a Flash application rather than using GWT. If direct access is so essential to you, you would have to abandon GWT and develop in Flash and run a httpd engine for your database server.
GWT is ultimately Javascript. As noted at Are there JavaScript bindings for MySQL?
, there is currently no way of accessing MySQL from Javascript.
Therefore you can't access it from client-side GWT code.
AFAIK it's not possible, and even if it were, it would be a really bad idea. Are you sure you actually need a database? Maybe something like gwt-client-storage would be more appropriate.
EDIT
Your database would we publicly accessible and open for any sort of attacks.
EDIT 2
This may even be a better solution, as it offers support for accessing the HTML5 Database API and is targeted to iPhone/iPad.
gwt-mobile-webkit
If you were even successful in doing so, in short, doing a CTRL + U on the browser would make your database name, username, password, tables names etc visible... And done, any developer curious to know your code has a way to hack anything and everything in your server.
I think it's not possible, I mean, if you want all your data stored in DBs. I mean, GWT compiles into javascript and javascript executes on the client (typically a web browser).
If you want to access data stored somewhere (by some mean) in a server, then you have no option but RPC. If I were you, I would stop thinking in client-server paradigm (GWT was developed with that in mind). Perhaps some embedded database like H2 and then hold connections through JDBC.