I have built a PHP API which queries data from some tables in an online SQL database. The credentials with which it connects to the database are saved in another file, and are loaded at start. The user with those credentials has SELECT priviledge only. The Android app just connects to the link and gets the data, so the API has no input at all. The queries are prewritten in the PHP script. The data in the database is all public, so if something else that's not in the script is read that's not so much of a problem.

How vulnerable is this setup to SQL Injection? (or other threats)

  • Where do you anticipate there being a threat? Dec 24, 2017 at 22:52

1 Answer 1


If there's no user input used to construct the queries, there's no threat of SQL injection.

This is a reasonably good way to go about allowing an Android app to get data from a shared database. The primary thing to think about are denial of service attacks - can one user make repeated calls to the endpoint that bring down the service (and potentially other apps or parts of the app that share the same infrastructure)? Appropriate use of caching and IP throttling will mitigate this for the most part, and monitoring that alerts you when there's an issue will allow you to deal with the rest as needed.

The only other thing I can think are standard generic web application attacks like having debug information turned on (leaking db credentials, filenames, etc. on errors), slowloris, and so on, but these aren't specific to your situation.

  • 6
    "If there's no user input used to construct the queries" -- the trick is to make absolutely sure that there's no user input. Including the user's ID that you're supplying your web service, or the page count, or anything like that. Even if it can't be modified freely in your app, a malicious user could reverse-engineer the requests and send whatever they want.
    – anon
    Dec 25, 2017 at 3:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .