Проверка безопасности

<?php

header("Access-Control-Allow-Origin: *");

​

$config = array(

    'host' => '123',

    'user' => '123',

    'pass' => '123',

    'base' => '123'

);

​

$db = new mysqli($config['host'], $config['user'], $config['pass'], $config['base']);

$db->set_charset("utf8");

​

switch ($_GET['api']) {

    case 'checkUser':

        $id = $_POST['id'];

        $first_name = $_POST['first_name'];

        $last_name = $_POST['last_name'];

        $sex = $_POST['sex'];

​

        $check = $db->query("SELECT * FROM users WHERE id = '$id'");

​

        $user = array();

        while ($row = $check->fetch_array(MYSQLI_ASSOC)) {

            array_push($user, $row['vk_id']);

        }

​

        //проверка юзера. есть ли в базе

        if (count($user) > 0 && is_array($user)) {

            $response = array(

                'error' => false,

                'status' => 'have_user'

            );

            echo json_encode($response);

        } else {

            $db->query("INSERT INTO users SET

                        id = '$id',

                        first_name = '$first_name',

                        last_name = '$last_name',

                        sex = '$sex'");

​

            $response = array(

                'error' => false,

                'status' => 'have_not_user'

            );

            echo json_encode($response);

        }

​

        break;

    case 'search':

​

        $url = $_GET['search'];

        $client_secret = 'UBWz2UOsqDjrTMyrSogN';

        $query_params = [];

        parse_str(parse_url($url, PHP_URL_QUERY), $query_params);

        $sign_params = [];

        foreach ($query_params as $name => $value) {

            if (strpos($name, 'vk_') !== 0) continue;

            $sign_params[$name] = $value;

        }

        ksort($sign_params);

        $sign_params_query = http_build_query($sign_params);

        $sign = rtrim(strtr(base64_encode(hash_hmac('sha256', $sign_params_query, $client_secret, true)), '+/', '-_'), '=');

        $status = $sign === $query_params['sign'];

        if (!$status && $_GET['vk_id'] != 9999999999) exit('fail'); // НЕ понинимаю условие && $_GET['vk_id'] != 9999999999

        break;

    default:

        echo json_encode(array('error' => true));

        break;

}

​

​

?>