C++/CURL - Passing data through PHP request the safe way? -

i'm trying send data curl php file , can other actions hashing password/data salt, running database queries eco. seems work fine, there's 1 problem. i'm not sure how secure it, authorization token example. want able query data php file using written application only. can see how become problem, if people had access link through web browser example.

i've included code below, if needs similar.

main.cpp

#include <iostream> #include <stdlib.h> #include <stdio.h> #include <curl/curl.h> #include <sha.h> #include <hex.h>  using namespace std; using namespace cryptopp;  size_t size = 0; size_t write_to_string(void *ptr, size_t size, size_t count, void *stream) {     ((string*)stream)->append((char*)ptr, 0, size*count);     return size*count; }  template <class t> string querydb(initializer_list<t> list) // use initialize_list query undefined number of params {     curl *curl;     curlcode res;      string submitdata = "", query_result;      int = 1;     (auto elem : list) // each param append submitdata string     {         if (i == 1) { // if first param, append "?"             string d = "?" + to_string(i) + "=" + elem;             submitdata.append(d);         } else if (i > 1) { // if not first param, append "&" it's second, third, fourth ... param             string d = "&" + to_string(i) + "=" + elem;             submitdata.append(d);         }         i++;     }      curl_global_init(curl_global_all);     curl = curl_easy_init();      if (curl)     {         string loginurl = string("http://localhost/login.php");          curl_easy_setopt(curl, curlopt_userpwd, "randomhttpuser:randomhttppassword");         curl_easy_setopt(curl, curlopt_url, (loginurl + submitdata).c_str());         curl_easy_setopt(curl, curlopt_writefunction, write_to_string);         curl_easy_setopt(curl, curlopt_writedata, &query_result);         curl_easy_setopt(curl, curlopt_timeout, 20l);         res = curl_easy_perform(curl);          if (res != curle_ok)             fprintf(stderr, "curl_easy_perform() failed: %s\n", curl_easy_strerror(res));         curl_easy_cleanup(curl);     }     else {         query_result = "connection failed";     }     curl_global_cleanup();      return query_result; }  string sha256hash(string input) {     sha256 hash;     string hashed_input;      stringsource ss(input, true, new hashfilter(hash, new hexencoder(new stringsink(hashed_input))));      return hashed_input; }  int main() {     string username = "testuser";     string raw_password = "testpass";      // hash password , send query php file     // query_result hold value of request response     auto hashed_password = sha256hash(raw_password);     auto query_result = querydb({ username, hashed_password });      cout << "=========================================== [ post ] ===========================================" << endl;     cout << "user: " << username.c_str() << endl;     cout << "raw password: " << raw_password.c_str() << endl;     cout << "hashed password: " << hashed_password.c_str() << endl;     cout << "========================================== [ request ] =========================================" << endl;     cout << query_result.c_str() << endl;       sleep(15 * 1000);     return 0; } 

login.php

<?php  $reqparams = array();  function addstringtoarray($name,$string) {     global $reqparams;     $reqparams[$name] = $string; }  /* check if specified param exists in reqparams array */ function getrequestparam($value) {     global $reqparams;      if (array_key_exists($value, $reqparams)) {         $returnvalue = $reqparams[$value];     } else {         $returnvalue = "invalid parameter";     }      return $returnvalue; }  $authuser = "randomhttpuser"; $authpw = "randomhttppassword"; $authorized = false;  if (!isset($_server['php_auth_user'])) {     header('www-authenticate: basic realm="my realm"');     header('http/1.0 401 unauthorized');     echo 'failed authorize!';     exit; } else {      if($_server['php_auth_user'] == $authuser && $_server['php_auth_pw'] == $authpw)     {         $authorized = true;     } else {         $authorized = false;         die('failed authorize!');     } }  if($authorized == true) {     /* store each request , it's value in $reqparams array using addstringtoarray function */     foreach ($_request $key => $value)       {         $value = addslashes($value);         $value = strip_tags($value);          addstringtoarray($key, $value);     }      /* should remember in order called params in request query or if want, can use:      $variable = $_request['param_name'];      however, if undefined param specified, result in warning , ruin output, if manually parse */      $user = getrequestparam(1);     $pass = getrequestparam(2);      /* getrequestparam returns 'invalid_parameter' instead of warning undefined param requested */     $invalid_param = getrequestparam(42);      /* re-hash password salt that's stored in php file only, before using or comparing value stored in database or doing whatever else */     $salt = $user . $pass . "secretkey42";     $salt_hashed_passsword = strtoupper(hash('sha256', $salt));      echo "user: $user";     echo "\nhashed password: $salt_hashed_passsword (salt)"; }  ?> 

edit: use http header, isn't possible reverse application , abuse it?

edit: decided use http authentication temporary measure.

i stored random generated username , password in php file , compare them php_auth_user/pw sent in http header cpp application using curlopt_userpwd:

curl_easy_setopt(curl, curlopt_userpwd, "randomhttpusername:randomhttppassword"); 

hopefully, @ least make bit harder hacker. first have re application the user/password , after can query response if password belongs specified user or not - since of queries hard coded. store number of failed logins , temporarily ban him x amount of time. rest of queries made after login returns true.

i've updated code above use changes i've made , added comments if you're lazy go on code line-by-line. feel free give me tips on how improve code or optimize better use.

from understood, want implement sort of login system using auth tokens. in case, oauth can job. here's tutorial written on sitepoint can guide through process.