ObjectiveC-PHP：传递字符串和安全问题

Question

I am new to iphone development. I am testing passing username from:

iphone/obj-c -> php -> Database/MySql -> php -> return to iphone

I have problem when I pass the username. Here is the code:

NSString *hostStr =[NSString stringWithFormat:@"localhost/username.php?username=%@", tf_username.text];

NSData *dataURL =  [NSData dataWithContentsOfURL: [ NSURL URLWithString: hostStr ]];    
NSString *serverOutput = [[NSString alloc] initWithData:dataURL encoding: NSUTF8StringEncoding];
NSLog(@"Server output: %@", serverOutput);

my php file(username.php)

<?php
// for testing, i simply output what i received
if(!empty($_GET['username'])){
echo $_GET['username'];
} else {
echo "No parameters";
}
?>

Here is the result when I enter:

Enter        I    Result
=============================================
test         I    Server Output: test
test test    I    Server Output: 

1. When I have a 'space', it will return blank. In php there is this URLEncode, must I encode the string in obj-c first?

2. What are the security flaws of my methods? (i know there are lots)

3. Is there any better approach/methods, when get data from web server database? (like my method is: obj-c -> php -> obj-c)

Thanks

Answer 1

1. See NSString's stringByAddingPercentEscapesUsingEncoding:, which will work fine. The only exception is that it will turn spaces into %20 instead of +, but you can easily do a string replace after encoding.
2. Given that you haven't really told us much, that's hard to say. Assuming "username" is just a search parameter and not a login credential, then nothing is flawed. Maybe you need to read up on HTTP RESTful APIs. It's pretty normal for a desktop application to make calls to a remote API. I'd formalize your input and output however, such as using JSON or XML if anything is required in the body of the request/response.
3. Again, what you're doing is normal. You're creating an API. If you need to read up on anything, read up on web service APIs (in particular REST... I'd avoid getting drawn into SOAP, which is scary and over-complicated IMHO).

PS: +URLWithString should really require a full URL (including the 'http://').