title: $_POST security for PHP Webservice
body: <p>I apologize if this question has been asked before, if it has just link me to it in a comment.</p>
  
  <p>So I've created a web-service for an android/iOS app with <code>php</code> that works like this.</p>
  
  <ol>
  <li><p>The app sends a request to <code>http://www.example.com/ws/getCookingData.php</code> with 2 <code>$_POST</code> paramaters <code>userID</code> and <code>foodType</code></p></li>
  <li><p>The <code>php</code> file then queries the database using those two variables and returns a <code>json_encode</code> result.</p></li>
  </ol>
  
  <p>My worry is that if someone were to discover my web-service link they could spam it with post requests resulting in 100's of call to my database that are just un-needed</p>
  
  <p>Below is an example of my current <code>getData.php</code> file</p>
  
  <pre><code>&lt;?php
  $userID = mysql_escape_string($_POST['userID']);
  $foodType = mysql_escape_string($_POST['foodType']);
  
  $mysqli = getDB();
  
  echo json_encode(getDate($mysqli, $userID, $foodType); //mysql database interaction is here
  
  $mysqli-&gt;close();
  ?&gt;
  </code></pre>
  
  <p>There is nothing here preventing hackers from attempting to post malicious SQL statements into my database</p>
  
  <p>So what I'm wondering is if I added a 3rd parameter to my post request called <code>appID</code> would this be a good solution?</p>
  
  <p>For example if I were to update my <code>getData.php</code> file to below would this be much more secure or is there a vulnerability I'm missing?</p>
  
  <pre><code>&lt;?php
  $appID = $_POST['appID'];
  
  if($appID === "hardCodedEquivalentID"){
      $userID = mysql_escape_string($_POST['userID']);
      $foodType = mysql_escape_string($_POST['foodType']);
  
      $mysqli = getDB();
  
      echo json_encode(getDate($mysqli, $userID, $foodType); //mysql database interaction is here
  
      $mysqli-&gt;close();
  }
  
  ?&gt;
  </code></pre>
  
  <p>If this is a good solution or there is already an equivalent practice that would achieve what I'm trying to do please let me know</p>