How to make a public JSON API

using PHP we can make our own API
then we can use that api with jquery and JSONP

NOTE!!!! - usually API's have some kind of authentication, so do that. That way you know who is using your API.

Category:

Science & Technology

Tags:

• API
• php
• json
• jsonp
• jquery
• callback
• youtube api
• google api
• facebook api
• learn
• basics

[Tchalvak]

HUGE security implications of calling any random function out of all of php's library of choices.

[optikalefxx]

@Tchalvak Totally! You should have a Class with your methods in it, not use procedural functions. In real use, you need to keep your API in it's own class scope.

[Tchalvak]

@optikalefxx I actually just use a whitelist:

$valid_type_map = array('user'=>'json_user', 'user_search'=>'json_user_sear­ch', 'item'=>'json_item', 'item_search'=>'json_item_sear­ch', 'product'=>'json_product', 'product_search'=>'product_sea­rch'); $res = null; // If the function exists, pass the data to it and execute it, encode the results, then wrap the encoded results in the callback. if (isset($valid_type_map[$type]) && function_exists($valid_type_ma­p[$type])) {

// Decode & call functions

[optikalefxx]

@Tchalvak But if you're doing your stuff in OOP which I recommend, then you don't have to keep an array, your methods on said class are your white list. You will use method_exists($this,"method_na­me") and it will keep scope. I use this idea in my php framework

[SomaVIII]

Personally with security concerns I'd have added some tests before calling a _GET variable as a functions. Also calling a _GET variable without checking if it is set will result in a PHP notice, not a bad thing but not good either.

[optikalefxx]

@SomaVIII Sorry I never responded to this. Yes there are big security flaws if this was a REAL api. This was just to show the basic principal. I think Ill make a secure versino of this so people can see what needs to be added

[irootbox]

2:40 $_GET['method') ...... hehe :D

[SomaVIII]

@optikalefxx True, I understand no need to get into security with a simple tutorial focused on one topic but just to let the ones who come to this before actually taking the time to learn the language and the web a heads up.

[cky2250]

do we need to stab the body :p

[mreis1969]

fock, you saved my life. I have been trying to understand how all those things should be done and know i got hell out of it.

thanks dude :)

[WireFunds]

How do I add a parameter (like an id) from the api method, and pass it in?

i.e. function getThisUser($id=$_GET['userid'­]){

$sql = mysql_query("SELECT * FROM users WHERE id = "$_GET['userid']);}

This doesnt seem to work, maybe I'm not initializing or capturing the url value properly.

Please help? This would be very useful if I could pass in variables from the url into the api methods. Thanks!