How to Connect Android App to Shared Hosting Backend (PHP & MySQL Guide)

1. Why Shared Hosting is Still Powerful for Android Backends

Modern shared hosting plans running PHP 8.2+ with OPcache and MariaDB/MySQL can easily serve tens of thousands of API requests daily at a fraction of cloud expenses. When configured properly with prepared statements and lightweight JSON endpoints, response times typically hover under 150 milliseconds.

2. Step 1: Setting Up the Database in cPanel

1. Log into your cPanel account and open MySQL® Databases.
2. Create a new database (e.g., jmdworld_appdb).
3. Create a dedicated database user with a strong 32-character password and assign ALL PRIVILEGES to the database.
4. Open phpMyAdmin and create your table:

CREATE TABLE `users` (
  `id` INT AUTO_INCREMENT PRIMARY KEY,
  `full_name` VARCHAR(100) NOT NULL,
  `email` VARCHAR(150) NOT NULL UNIQUE,
  `password_hash` VARCHAR(255) NOT NULL,
  `device_token` VARCHAR(255) DEFAULT NULL,
  `created_at` DATETIME DEFAULT CURRENT_TIMESTAMP
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

3. Step 2: Crafting Secure PHP REST API Endpoints

Never connect your Android app directly to MySQL using JDBC or exposing port 3306! Instead, build a secure RESTful API layer in PHP. Create an endpoint file api/login.php on your hosting server:

<?php
/**
 * JMD WORLD - Production Secure Login Endpoint
 */
header('Content-Type: application/json; charset=UTF-8');
header('X-Content-Type-Options: nosniff');

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(['success' => false, 'message' => 'Method Not Allowed']);
    exit;
}

// Database Connection with PDO
$host = 'localhost';
$dbname = 'jmdworld_appdb';
$user = 'jmdworld_dbuser';
$pass = 'YourSecretComplexPassword!2026';

try {
    $pdo = new PDO("mysql:host=$host;dbname=$dbname;charset=utf8mb4", $user, $pass, [
        PDO::ATTR_ERRMODE => PDO_ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
        PDO::ATTR_EMULATE_PREPARES => false,
    ]);
} catch (PDOException $e) {
    http_response_code(500);
    echo json_encode(['success' => false, 'message' => 'Database connection failed']);
    exit;
}

// Read raw JSON request payload from Android client
$rawInput = file_get_contents('php://input');
$data = json_decode($rawInput, true);

$email = filter_var(trim($data['email'] ?? ''), FILTER_VALIDATE_EMAIL);
$password = trim($data['password'] ?? '');

if (!$email || empty($password)) {
    http_response_code(400);
    echo json_encode(['success' => false, 'message' => 'Valid email and password required']);
    exit;
}

// Query user using prepared statement (immunizing against SQL injection)
$stmt = $pdo->prepare("SELECT id, full_name, email, password_hash FROM users WHERE email = ? LIMIT 1");
$stmt->execute([$email]);
$userRow = $stmt->fetch();

if (!$userRow || !password_verify($password, $userRow['password_hash'])) {
    http_response_code(401);
    echo json_encode(['success' => false, 'message' => 'Invalid email or password']);
    exit;
}

// Generate simple authenticated session token
$authToken = bin2hex(random_bytes(32));

echo json_encode([
    'success' => true,
    'message' => 'Authentication successful',
    'data' => [
        'user_id' => (int)$userRow['id'],
        'name' => $userRow['full_name'],
        'email' => $userRow['email'],
        'token' => $authToken
    ]
]);
?>

4. Step 3: Android Client Implementation with Retrofit

Define your request and response models in Kotlin:

data class LoginRequest(
    val email: String,
    val password: String
)

data class ApiResponse(
    val success: Boolean,
    val message: String,
    val data: T?
)

data class UserSession(
    val user_id: Int,
    val name: String,
    val email: String,
    val token: String
)

interface AuthApiService {
    @POST("api/login.php")
    suspend fun login(@Body request: LoginRequest): Response>
}

Create the Retrofit singleton client pointing to your shared hosting domain with SSL (HTTPS):

object ApiClient {
    private const val BASE_URL = "https://yourdomain.com/"

    val authService: AuthApiService by lazy {
        Retrofit.Builder()
            .baseUrl(BASE_URL)
            .addConverterFactory(GsonConverterFactory.create())
            .build()
            .create(AuthApiService::class.java)
    }
}

5. Critical Shared Hosting Rules for Production

• Always Force HTTPS: Add an SSL redirection rule in your backend .htaccess so all plain HTTP requests redirect to HTTPS, preventing plain-text credential sniffing.
• Prevent Directory Browsing: Add Options -Indexes to your root .htaccess file to hide files and script names from inquisitive eyes.
• Disable MySQL Remote Access: Ensure MySQL is only bound to localhost (the default on shared hosting) so outside connections cannot probe your database ports directly.