title: seeking advise for a mobile client-server application strategy
body: <p>I'm seeking advice regarding the following plan that I have for a certain future project of mine.</p>
  
  <ul>
  <li>The big picture
  <ul>
  <li>I want to produce a mobile client (iOS, Android, Windows Phone, etc.) that will query (read/write) to a database from my website and display its results.</li>
  <li><em>plus several other features...</em></li>
  </ul></li>
  </ul>
  
  <p>I know that directly accessing the database (bypassing the web server) from the client is a bad idea especially over the internet. I think most shared webhosting plans prohibit this anyway. So here is my intended solution...</p>
  
  <ol>
  <li>Mobile client sends data to the webserver through an API call.</li>
  <li>The webserver processes the REST API call and queries the database. The webserver works as the middleware between mobile client and database server.</li>
  <li>The webserver receives the results from the DB queries and passes them to the mobile client.</li>
  <li>Mobile client displays/manipulates the data on the client-side.</li>
  </ol>
  
  <p>My experience with APIs are limited to the consumption of Twitter, Instagram, and Google Shopping APIs. From my experience, it seems to be best to transport data between mobile and webserver in JSON format.</p>
  
  <p>Now, here are my concerns...</p>
  
  <ol>
  <li>How can I ensure that only the logged-in users can use the API? Is OAuth the solution?</li>
  <li>For the REST API, is it better if it is RESTful?</li>
  </ol>
  
  <p>The current environment of the website is on shared hosting with PHP and MySQL though I'm thinking of moving it to cloud-based services in the future. I'm planning to implement the middleware using either CodeIgniter or CakePHP or Apify.</p>
  
  <p>I would appreciate if anyone can critique my plans above or present better alternatives than the ones I have in my head.</p>
  
  <p>Thanks in advance.</p>