Calling php file from javascript using jQuery.get(), location of php?

Question

Before closing this as duplicate, please know that I read many similar questions on SO and none of them answers my doubt.

I am trying to call my .php file using jQuery.get()

$.ajax({
 url: url,
data: data,
success: success,
dataType: dataType
});

I am using wordpress and the javascript code from where I am trying to call the php file is included in the page's header.

I put the php file in a my-includes folder in the root of server, so I can access it using url:/my-includes/xxx.php . (thanks go to OSDM for his answer)

But now it is publically accessible using domain-name/my-includes/xxx.php

My question is-

Is this how websites work. Isn't this a security risk?
can I make this file inaccessible to general public yet keep it working for my site?

Community · Accepted Answer · 2017-05-23 11:43:59Z

1

If you make the url like this: url: '/folderintheroot/file.php' it will start from the root of your website no matter what the url is. The key here is: '/' at the beginning.

Regarding security issues. If people can visit your website, that means they can see everything that is send from the server to their computer. So when that script is called with jquery.get() it is exactly the same. Basically whatever is public, is public. Else you have to start working with login and password, but that is a whole other story.

There is one thing you can do though, see here: Using .htaccess, prevent users from accessing resource directories, and yet allow the sourcecode access resources

edited May 23, 2017 at 11:43

CommunityBot

11 silver badge

answered Jul 11, 2015 at 4:32

OSDM

2751 gold badge2 silver badges10 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

rents Over a year ago

I created a folder and put the php file in there. Does the file need to be publically accessible like this - domainname.com/<folder-name>/xxx.php ?

OSDM Over a year ago

If you are accessing from the same domain name, you don't have to put the domainname, just: /<folder-name./xxx.php

rents Over a year ago

From you comment I assume that it doesn't matter if this path "/<folder-name>/xxx.php" is publically accessible (via anyone or not). 1 unrelated question though, does this also apply to a javascript file as well? Suppose I want to call a javascript file using <script type="text/javascript" src="/my-scripts/updatepage.js"></script>. Does the path I need to give is the along the same lines as suggested by you?

rents Over a year ago

actually, I created a folder at the root but now everything I am putting in this folder .js, .html is accessible via domain.com/<folder>/.js Any idea how to make it inaccessible to general public?

rents Over a year ago

Also found this -an ajax request is a normal http request so that means the php file should be publically accessible? That brings me back to my original question. Isn't this a security risk?

Community · Accepted Answer · 2017-05-23 12:29:50Z

0

Yes, this is generally how websites work. Any content that you want to serve to a client must be accessible to them - how else will it make its way to their computer?

Is it a security risk? Only if you don't want people to see that data, but if that's the case then you shouldn't be serving it up. For data that should only be sent to selected individuals rather than making it universally accessible you should use some form of authentication - only serve the data if the user has been authenticated.

There are countless ways of doing authentication, take a look at PHP best practices for user authentication and password security for some ideas.

edited May 23, 2017 at 12:29

CommunityBot

11 silver badge

answered Jul 11, 2015 at 15:24

Eborbob

1,9851 gold badge17 silver badges31 bronze badges

2 Comments

rents Over a year ago

I think I got a way to restrict access to php files yet still call them from my websites using .htaacess file. I don't think it makes sense for people to see the actual code, it doesn't make any sense.

Eborbob Over a year ago

Perhaps I've misunderstood what you're trying to do. The source code of PHP files shouldn't be accessible, the PHP files should be interpreted by your webserver and the resulting HTML served up. You shouldn't need to be using .htaccess files to control that though.

Collectives™ on Stack Overflow

Calling php file from javascript using jQuery.get(), location of php?

2 Answers 2

5 Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

5 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related