Create a new php file (webapi.php) and save it to the root of your site.
Add in the required files to access the Joomla Framework like so:
//ALLOW DIRECT ACCESS
define('_JEXEC', 1);
require_once $_SERVER['DOCUMENT_ROOT'].'/includes/defines.php';
require_once $_SERVER['DOCUMENT_ROOT'].'/includes/framework.php';
$app = JFactory::getApplication('site');
$app->initialise();
$JInput = JFactory::getApplication()->input;
$secretKey = $JInput->get('secretKey','','string');
$request_data = $JInput->get('request','','array');
Using the Joomla Framework allows you access to everything already in your database, no need for an external framework to do what Joomla is already built to do.
For encryption:
Have your mobile app pass a secret key and whatever other request data you may want to pass to query your database with.
Write some simple validation that will check your secret key against your site. Or for that matter use the secret key in your config file if you wanted to even though I don't recommend that. You can base64_encode they key on the mobile apps end then decode it back on your end. Or better still, HASH the key on the mobile apps end using a secret key, the check the value of the hash against your private key on the server side.