MySQL DB is hackable?

Discuss
#26

Hi @ShaikhSajidAli
So i had just read lots of documentation about this.
I didn’t get any clue :pensive:. So how to protect url.

#27

i have same problem . People using script to hack database in my people add money via referral code

#28

Same with my case. I don’t know what should do we now?

#29

Use Firebase. And use the secure google login.

#30

But firebase not have data structure like MySQL and its more cheaper than firebase

#31

furthermore we cannot run queries in firebase . can we?
But if @Kodular adds firebase firestore component then it would be possible…

#32

Well for me as i developing for my project i make api for mysql using jwt and slim or node.js it prevents sql injection and other attacks

#33

Would you like share some tips or tutorial. i am beginner and kodular help me lots learn how to develop app without coding

#34

Thats nice but if we not allow the user to run any query by his own and everything is highly programmed in kodular even then he can hack???

#35

I didn’t believe on this all thing depends on your logic not kodular

#36

Did you try with rooted phone or with non-rooted. I was able to sniff only with my rooted tablet.

#37

I was also tried in rooted phone

#38

So with non-rooted phone?

#39

I had try but not successful.

#40

So the problem is the users with rooted phones. You can use Device Utilities and forbid these users to open your app. If they can’t open your app and run the queries they will not get any response back.

#41

It’s Possible You Can Capture MySQL Data With Non-Rooted Phone
I Have Huawei Nova 3i Android 9.1
I Test this in my phone and it’s work. you can capture all MySQL Requests and Reponses

1 Like
#42

Same thing happens with browser also you can get response and request but you can’t normally hack that because query runs on server side not from client side.
Client doesn’t make any query its old time that query executed from client side now everything works mainly in server side.

1 Like
#43

That’s exactly what I was going to quote …
I still don’t understand how they are getting into your database …
I think because I’m hungry and I haven’t had lunch yet …
:grin:

#44

You are passing SQL commands via Kodular POST blocks, is that it?
I run them on the server.

#45

It was a good read and finally came to proper conclusion.

Best practice is to have your queries on the server side nd use android to just make a web connection.