I am currently part of a team trying to build an e-commerce platform with Magento, and we also happen to need a way for the site to interact with a mobile app we are developing in parallel. We ran into problems with REST (highly convoluted token setup for a mobile app) and SOAP (too slow), but I was able to get something to work by creating my own PHP files on the web server that call Mage.php for relevant queries.

I keep my PHP files in a self-made folder that can be accessed through a URL that looks this:


The app sends data to these PHP files through HTTP Post, and the PHP script processes the data received before finally sending response data back to the app. This has so far been really useful since it has turned out to be much faster, and allows us to work with custom functionality we have added to the website since. But I would like to know if this is considered secure.

For what it's worth I always make sure that sensitive data queries are accompanied with a username and password for authentication without which the PHP script will not do anything, and as far as I know the inner workings of a PHP file should remain hidden from the user. Is there any inherent problem with setting up the client-server functionality this way? Is there a better/easier way of allowing the app to properly talk to the server?

  • I think this question is not about Magento specifically, but more about PHP or not even that, more about internet security in general...
    – 7ochem
    Mar 9, 2015 at 8:35

1 Answer 1


How secure your custom code is depends on the code entirely. If you coded it in a secure Way then it'll be secure if you leave open huge vulnerabilities then it's not.

If you are doing any SQL queries that rely upon user input then make sure it's sanitised before inserting you can use the models where possible to help in this process.

Avoid using calls to the shell which can run commands on the operating system.

Not the answer you're looking for? Browse other questions tagged or ask your own question.