My guesses are either:
- you are using your own JSON to make a web-service,
- you are using someone else's JSON to make a web-service, or 3. you are trying to make your own JSON API.
Using Your Own JSON
WHY would you be doing that? Everything is simpler if you just stick with php. Just make cookies. If you want to use JSON, it's still going to require cookies! Same thing but a lot more complicated, and easier to hack!
Using Other Website's Provided JSON
First of all that is not JSON. That is an array. If that code you provided was you already converted from json to array, lets change that:
$string = file_get_contents("http://www.website.com/api.json"); // gets file content
$decoded=json_decode($string); // creates objects (not array... this makes it easier (for me))
$item = $decoded->item-string; // generates the string from an item's name
Repeat $item if you need more than one.
use $item = $decoded->item-string->secondary-item-string;
to get an item within an item.
Creating Your Own Login API
First of all, you are not using JSON at all. That is a PHP output array I believe. You can use json_encode to encode the array to JSON.
Instead of having the site developers directly make a login form (which is what I think you are trying to do), let them use YOUR login system. This way, they can't secretly "steal" passwords by making a false login... etc, etc.
First make a php file called, for example, loginapi.php. Use htaccess to rewrite loginapi.php to loginapi.json (Rewrite Engine) then make a .html file for the login form, for example loginform.html
Assuming that you use $isloggedin to check if the user is logged in or not:
header ('Content-type: text/javascript; charset=utf-8');
if($isloggedin == "yes"){
$arr = array("isloggedin" => "yes", "item1" => "output1", "item2" => "output2", "item3" => "output3");
}
else {
$arr = array("isloggedin" => "no", "html" => "<iframe src=\"http://www.yoursite.com/loginform.html\" width=\"400\" height=\"200\" style=\"border:none;\"></iframe>");
}
echo json_encode($arr);
↑ This tells the developer if the person is logged in or not. ↑
You can also make an "api key" so that
- You can find out all the developers that are using your API
- You can monitor/restrict the people who uses your API
To do this, you must create a table in your database for developer api keys. Then use $_GET['key']; to check if there is an api key involved or not. Then check the database for a matching api key or not.
In the place where you accept developers for API keys, let the developer enter their website url, and use a hash to make the key, for example md5.