StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
primarykey
Id
18444627
data
AcceptedAnswerId
0
AnswerCount
0
ClosedDate
CommentCount
2
CommunityOwnedDate
CreationDate
2013-08-26T12:53:08.977
FavoriteCount
0
LastActivityDate
2013-08-26T12:53:08.977
LastEditDate
LastEditorUserId
0
OwnerUserId
2120416
ParentId
18335249
PostTypeId
2
Score
4
ViewCount
0
LastEditorDisplayName
text
Body
Why don't you try sending your API_KEY in custom headers which can be triggered along with php or ajax requests from the client side, that way your API_KEY is not visible in the URL at all, later which can be ripped of from the server using <code>apache_request_headers()</code>, it is a much safer approach, if you are still not satisified you can implement HMAC http authentication, which is damn safe, I bet you. Approach 1:(without HMAC) Client Side: using Jquery <code>$.ajax({</code> <code>url: 'foo/bar',</code> <code>headers: { 'api_key': 'API_KEY' }</code> <code>});</code> Using PHP <code>header('api_key':'API_KEY');</code> by adding header with the request the URL can be just <code>http://website.com/index.php?movie=Titanic</code> On serverside: <code>$headers = apache_request_headers();</code> <code>if(isset($headers['api_key']))</code> <code>{</code> <code>// validate your api_key from database</code> <code>}</code> Approach 2: (with HMAC) In this case, there is a slight change, instead of sending API_KEY in your url as query string , you will have to send userID or any other unique identifier, inorder which is related to the api_key in your database. on client side: do HMAC as given in <code>https://code.google.com/p/crypto-js/#HMAC</code> or using php function <code>hash_hmac()</code> using both methods you will get a hashed value which is a combination of your API_KEY , and your data eg. <code>$hashed_value = hash_hmac('sha1','titanic','API_KEY');</code> <code>header('hash':$hashed_value);</code> your url <code>http://website.com/index.php?movie=Titanic&uid=xx</code> On server side: <code>$headers = apache_request_headers();</code> <code>if(isset($headers['hash']))</code> <code>{</code> <code>// then try to recreate your hash in server, like</code> <code>//using $_GET['uid']= get your API_KEY from DB</code> <code>$api_key = getApiKey($_GET['uid']);</code> <code>$hash = hash_hmac('sha1',$_GET['movie'],$api_key);</code> <code>if($hash==$headers['hash'])</code> <code>{</code> <code>// User authenticated </code> } <code>}</code> If you go through <a href="http://en.wikipedia.org/wiki/Hash-based_message_authentication_code" rel="nofollow">HMAC</a>, you can figure out its benefits.
Tags
Title
singulars
PostAcceptedAnswerId
1. This table or related slice is empty.
PostParentId
1. POHow to make sure the API request is made from the certain person who can do that?
 singulars
 PostTypePostTypeId
 PTQuestion
PostTypePostTypeId
1. PTAnswer
UserLastEditorUserId
1. This table or related slice is empty.
UserOwnerUserId
1. USMohammed Asad
plurals
PostLinksPostIdRelatedPostId
1. This table or related slice is empty.
PostLinksRelatedPostIdPostId
1. This table or related slice is empty.
PostsAcceptedAnswerId
1. This table or related slice is empty.
PostsParentIdCreationDate
1. This table or related slice is empty.
VotesPostIdCreationDate
1. VO
 singulars
 PostPostId
 PO
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
2. VO
 singulars
 PostPostId
 PO
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTDownMod
3. VO
 singulars
 PostPostId
 PO
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
CommentsPostId
1. COHeaders can still be read. All the user needs to do is examine the request in something like firebug or google chrome's built in dev tool.
 singulars
 PostPostId
 PO
 UserUserId
 USabjbhat
2. COYeah, I agree, that the header data is still visible in dev. tools of browsers, but still using approach 2, it makes it secure than making it vulnerable. I think that you know that Hash is not going to be decoded easily unless, the hacker know the api_key.
 singulars
 PostPostId
 PO
 UserUserId
 USMohammed Asad

Querying!

Guidance

A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.