Database android 应用程序与 web 服务通信的安全性

过了这段时间，我带着我自己的问题来了一些答案.这些技巧是针对Android应用客户端的php服务器端的，但其逻辑可以在服务器端的其他语言中使用.

Security :
    1- Validate input data
    2- Filter input data
    3- Bind parameters to refuse query injection
    4- Give least access to user
    5- Refuse Leakage info by disableing log and httpd.conf


    6- Output Escaping : 
        escape html in output for sites and useless for webservices
        Functions like : htmlspecialchars()


    Filter      : diagnose XSS characters and filter them
    Validate    : check if input data is like the data type we expect

    Filter functions    :
        strip_tags()
        str_replace()
        preg_replace()
        Force Change DataType by placeing datatype before them : $input = (int) $input;


    Validat functions   :
        stripos()
        preg_match()
        "ctype" functions like : ctype_alnum(text), ctype_alpha(text), ctype_digit(text) : if input is ctype validate type return true else return false

        isset()
        filter_var()


    Access to user :
        initialize all variables before use
        use if and else statements to check everything is ok to prevent showing errors
        try catch for PDO SQL errors
        HASH the password and important data in database
        set hard names for database tables and columns
        make index.php in the folder and use this code :
            <?php
                header('location',HOME_URL);
                exit;
            ?>
        in .htdocs paste this code : Options -Indexes



    Database security :
        $mysqli->real_escape_string($input); // for scape chars like ' " 
        use stored procedures for refuse query injection.
        filter inputs for : stripos($input, 'UNION')

我希望这些小贴士能帮上忙.