Prevent user to see directly PHP url in Javascript

Question

I want to prevent user to see directly PHP URL in Javascript. Example :

{
$.ajax(
{
    type: "POST",
    url: "search.php",
    data: dataString,
    cache: false,
    success: function(html)
    {
        $("#display").html(html).show();
    }
});
}return false;

Is it possible or any way to prevent user see the php URL when He/She view the source of my page ? Sometimes user maybe try to open the php url directly.

Thanks for helps.

So you mean like not allow the user to see a PHP URL? PHP is not available to the user, so even if they tried they wouldn't be able to see it. So can I assume you mean the POST variable correct? — greduan
– greduan, Commented Sep 20, 2012 at 1:28
I assume, you dont want user to see search.php . Its not possible. Everything js uses is on client side, and once something is on client side, you cannot hide it — Jashwant
– Jashwant, Commented Sep 20, 2012 at 1:31
@EduardoLávaque no, I mean when User want to see the source of my page, He/She can see the php url still in the source. Example in my post JS. search.php — Naga Botak
– Naga Botak, Commented Sep 20, 2012 at 1:32
@Jashwant So now how can We prevent the User open directly the PHP url ? — Naga Botak
– Naga Botak, Commented Sep 20, 2012 at 1:34
If your page is on a public server then anyone can get to it at any time with any parameters. It is, after all, public. — Peter Gluck
– Peter Gluck, Commented Sep 20, 2012 at 1:40

Community · Accepted Answer · 2017-05-23 10:25:08Z

3

I (or any client) can still use any number of tools to figure it out (including the built-in debugger in 99% of the browsers built)--It's not worth obfuscating it.

If you're concerned about direct access, check for an AJAX request in your script. (Still hack-able, but it's a start). As also provided in a previous answer:

<?php

  $isAjax = isset($_SERVER['HTTP_X_REQUESTED_WITH'])
         && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) === 'xmlhttprequest';
  if (!$isAjax) die('Unauthorized access');

  /* rest of search.php */

edited May 23, 2017 at 10:25

CommunityBot

11 silver badge

answered Sep 20, 2012 at 1:32

Brad Christie

102k16 gold badges160 silver badges200 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

greduan Over a year ago

Yep, like Jashwant and Brad said, there isn't actually any way to hide it, and if there is then it's not perfect. :/

Netorica Over a year ago

well the problem here is some web configuration doesn't allow the HTTP_X_REQUESTED_WITH header for some security reasons yiiframework.com/forum/index.php?/topic/…

Jashwant · Accepted Answer · 2012-09-20 01:43:34Z

0

As stated in comments,

How can We prevent the User open directly the PHP url ?

You should create a session of very long random string (token) in your php and pass it to the js ajax function, so that it sends the token along with the ajax request. On server side you can check if its the same token generated. You may want to expire the token soon.

I dont know, if its the standard way, but can provide you a start.

answered Sep 20, 2012 at 1:43

Jashwant

29.2k16 gold badges76 silver badges110 bronze badges

1 Comment

Brad Christie Over a year ago

The problem with a token is that any information that you pass off to javascript can be easily deciphered and imitated. Even if you make a new hash for ever request,t he algorithm that generates that hash is also visible. Long story short, if you want it protected, don't give the user access or visibility.

Netorica · Accepted Answer · 2012-09-20 02:00:25Z

0

Ok to make things clear..

Once its on the client-side(the browser) you can't hide it. Users can still download or view source the client-side return.
Obfuscating is not really needed because you just make things complicated and not protecting anything.
But anything that is server-side code(PHP) will not be shown as it is processed by the server-side and the server just return the results of execution of the server-side code.

well in case of your problem the thing you can do is to check whether the $_POST and $_GET parameters are valid upon reaching your PHP codes thus making every POST and GET request valid and safe. its somewhat like this

<?php
  if(isset($_POST['username']) && isset($_POST['password'])){
    //everything seems fine
    echo 'ok';
  }
  else{
  //someone is doing a direct acess
     header('index.php');
  }
?>

or check the sessions to protect your pages only for logged-in users

  <?php
      if(isset($_SESSION['userid'])){
        //everything seems fine
        echo 'ok';
      }
      else{
      //someone is doing a direct acess
         header('index.php');
      }
    ?>

edited Sep 20, 2012 at 2:00

answered Sep 20, 2012 at 1:38

Netorica

19.5k19 gold badges78 silver badges109 bronze badges

2 Comments

Naga Botak Over a year ago

if I using your 2 ways, ok now I'm logged in, and what about if I open example search.php (inside maybe query of view any data) ?

Netorica Over a year ago

well if the php is requested with valid request method and its parameters it can be still opened. the answer of @Brad Christie is a good start but I had encounter many problems about it because of some web server configurations that removes that header

Collectives™ on Stack Overflow

Prevent user to see directly PHP url in Javascript

3 Answers 3

2 Comments

1 Comment

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

1 Comment

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related