Using XML-RPC in Secure Database Administration on the Web

Size: px

Start display at page:

Download "Using XML-RPC in Secure Database Administration on the Web"

Alberta Stone
5 years ago
Views:

1 Using XML-RPC in Secure Database Administration on the Web Silvana Solomon Department of Digital Communications University Al.I.Cuza of Iasi, Romania Catalin Varvara RoeduNet, Iasi, Romania

2 Remote Procedure Call Procedure call - a service needed in order to make use of the capabilities that are accessible from other computers RPC simple extension to the procedure call idea Cross-platform approach for RPC

3 XML-RPC XML-RPC a powerful instrument combination of XML and RPC technologies XML-RPC - a specification and a set of implementations, a remote procedure calling using HTTP as the transport and XML as encoding allows complex data structures to be transmitted, processed and returned known implementations

4 XML-RPC vs. Soap SOAP(Simple Object Access Protocol) protocol for exchange information in a decentralized, distributed environment. XML based protocol. XML-RPC Performs remote procedure call at a simple level Easy to use, but has fewer capabilities Recommended for standard data types and simple method calls SOAP Has named structs and arrays, polymorphic ancestors and enumerations More utilities and is less natural to use Better solution for complex user defined data types

5 XML-RPC for PHP Use of a collection of PHP classes that provides a framework for writing XML-RPC clients and servers in PHP, from xmlrpc.usefulinc.com Files in distribution: xmlrpc.inc xmlrpcs.inc include client.php server.php include

6 Xmlrpc client The basic class used to represent a client of an XML-RPC server Creation $client=new xmlrpc_client ($server_path, $server_hostname, $server_port); Send method:$response=$client->send ($xmlrpc_message, $timeout, $server_method); SetDebug method: $client->setdebug($debugon);

7 Xmlrpc server Xmlrpc server Minimal example: function my_select ($params) {... } $s=new xmlrpc_server ( array("db_select" => array("function" => "my_select", "signature" => $my_select_sig, "docstring" => $my_select_doc) ) ); Dispatch map array containing the information that server needs service the XML-RPC methods you define

8 XML-RPC and Secure Database Administration WebClient1 WebClient2 XML-RPC client DB server XML-RPC server

9 Steps in creating and sending the XML-RPC request (1) WebClientX makes a request to the XML-RPC client through a method called show_products_ofmycompany() for example show_products_ofmycompany() in XML-RPC client calls a generic function to fill the fields of a struct object, looking like: $select_param=new xmlrpcval (array( field_list" => new xmlrpcval (""), "tbl_id"=> new xmlrpcval("6"), "where" => new xmlrpcval(""), "group by" => new xmlrpcval(""), "order by" => new xmlrpcval(""), "having" =>new xmlrpcval("") ), "struct" );

10 Steps in creating and sending the XML- RPC request(2) Representing the request to the XML-RPC server: $f = new xmlrpcmsg('db_select',array($select_param)); Creating an XML string representing the XML-RPC message: htmlentities($f->serialize()); Creating the client instance: $client=new xmlrpc_client ("RPC/server.php", " ", 80); Sending the encapsulated request to the server. The result is kept in $r variable: $r=$c->send($f);

11 Steps in creating and sending the XML- RPC request(2) The header of XML-RPC request POST /RPC HTTP/1.0 User-Agent:PHP/4.0.5 Host: Content-Type: text/xml Content-length: 558 The body of XML-RPC request <?xml version="1.0"?> <methodcall> <methodname>db_select</methodname> <params> <param> <value><struct>... <member><name>tbl_id</name> <value><string>6</string></value> </member>... </struct></value> </param> </params> </methodcall>

12 Steps in processing the XML-RPC request(1) $sno=$m->getparam(0); // if it's there and the correct type if (isset($sno) && ($sno- >scalartyp()=="struct")) { //create the SQL query regarding to the SQL //Server- here MySQL //calls a function that will execute effectively the //MySQL command: //query_result($query,$func_name) //returns to the XML-RPC client the result of the //query : new xmlrpcresp($q_result); //where $q_result is the XML-encapsulated //record set; this is done using a function called //rst2xml(&$rst); }

13 Steps in processing the XML-RPC request(2) The header of XML-RPC response HTTP/ OK Date: Mon, 28 Apr :28:53 GMT Server:Apache/ (Win32) X-Powered By:PHP/4.0.5 Content-length: 148 Connection: close Content-Type: text/xml The body of XML-RPC response <?xml version="1.0" encoding="utf-8"?> <methodresponse> <params> <record1> <prod_name> <value><string> Painting cans </string></value> </prod_name>... </record1> <record2>... </record2> </params> </methodresponse>

14 Conclusions The goal of this protocol - to lay a compatible foundation across different environments, no new power is provided beyond the capabilities of the CGI interface. Firewall software can watch for POSTs whose Content-Type is text/xml. We use the XML-RPC technology in order to securely transfer database contents on the Web.

Using XML-RPC in Secure Database Administration on the Web

Using XML-RPC in Secure Database Administration on the Web Silvana Solomon Department of Digital Communications University Al.I.Cuza of Iasi, Romania sylvy@uaic.ro Catalin Varvara RoEduNet Iasi Branch