Android应用程序与webservice通信的安全性

Question

I am developing an android app for a site, which I made a capability in it that users can send data to the site database in the app. I use PHP web services and URL in android code for connecting to the web service. how can I make my app (and my php web service) secure that no one can't find the web service url by debugging my apk and send amount of data to the site and make the site down.

any tips for make software system secure from these kinds of dangers can help me a lot, thank you.

edit : for example now I use AsyncTask for sending data in my edittext to webservice like below. I use this code in my oncreate to send data to AsyncTask class in the name of AskServer() :

link = "http://mywebservice-adrress/name.php";
new AskServer().execute(link, edttext.getText().toString());

and here is my doInBackground of my AsyncTask class :

@Override
    protected Object doInBackground(String... params) {
        BufferedReader buf = null;

        try {
            URL link = new URL(params[0]);
            URLConnection connect = link.openConnection();

            connect.setDoOutput(true);
            OutputStreamWriter osw = new OutputStreamWriter(connect.getOutputStream());
            String data = URLEncoder.encode("field","UTF8") +"="+ URLEncoder.encode(params[1], "UTF8");
            sw.write(data);
            osw.flush();
        } catch (Exception e) {e.printStackTrace();}

        return null;
    }// end doInbackground()

and here is my php code in my web service :

<?php

include 'config.php';
$field=$_POST['field'];


mysql_query("insert into `wp_comments` (`comment_content`)
                    values('$field')");
?>

It is an example and my real code send much more data to server, and maybe code above doesn't work, I just make my question more exact and specific as stackoverflow want me. my question is how to make these transactions safe and secure from hackers which may debug my code and find my url , in code above (params[0]) and send amount of data to my site and make it down. or how can I use the service of sending data to server more secure from these kind of dangers??

Answer 1

After this time pass I come with some answers with my own question. these tips are for php server side of android app client, but the logic can use in other languages of server side.

Security :
    1- Validate input data
    2- Filter input data
    3- Bind parameters to refuse query injection
    4- Give least access to user
    5- Refuse Leakage info by disableing log and httpd.conf


    6- Output Escaping : 
        escape html in output for sites and useless for webservices
        Functions like : htmlspecialchars()


    Filter      : diagnose XSS characters and filter them
    Validate    : check if input data is like the data type we expect

    Filter functions    :
        strip_tags()
        str_replace()
        preg_replace()
        Force Change DataType by placeing datatype before them : $input = (int) $input;


    Validat functions   :
        stripos()
        preg_match()
        "ctype" functions like : ctype_alnum(text), ctype_alpha(text), ctype_digit(text) : if input is ctype validate type return true else return false

        isset()
        filter_var()


    Access to user :
        initialize all variables before use
        use if and else statements to check everything is ok to prevent showing errors
        try catch for PDO SQL errors
        HASH the password and important data in database
        set hard names for database tables and columns
        make index.php in the folder and use this code :
            <?php
                header('location',HOME_URL);
                exit;
            ?>
        in .htdocs paste this code : Options -Indexes



    Database security :
        $mysqli->real_escape_string($input); // for scape chars like ' " 
        use stored procedures for refuse query injection.
        filter inputs for : stripos($input, 'UNION')

I hope these tips help