The problem of using PHP+API interface to send SMS to catch the password of packet

I want to use a text message API to do a bulk message program, the API is provided by the official submission method as follows:
http://www.xxxx.com/abc?action=send&userid=12& account= account & password= password &mobile= 15023239810&content= content &sendtime=&extno=

Open software, users sign up for a free account can send text messages, and send text messages unified use of my API account and password.

I use PHP curl_setopt function to submit, but will be caught the tool caught my account and password, ask master, how to break? Thank

Reply to discussion (solution)

Can't break, you can't change the format required by the API provider

No way, because API-defined interfaces are like this

Unless you can modify the parameters obtained by the API interface to encrypt first, then accept the decryption

API design issues, the proposed API is changed to a more secure authentication method, do not clear account password.

On the internet basically all the SMS Bulk API is this, ...

PHP executes the Access SMS API interface on the server side. You got to grab the bag from the server.

The key is that the middle device can also grab the bag. It's always an unsafe way.

