0

I'm working with my JS files, what i have now is a unique php file with JS header, if a variable is set it includes the real js file, which is fine.

The "home" page has the script tag for the php-js file:

<head>
    <script type="text/javascript" language="javascript" src="bootstrap.php"></script>
</head>

the bottstrap.php file has something like:

if(isset($hostData) && !empty($hostData)) {
    include('bootstrap.js');
}else {
    echo "document.write('<center><bold>PLEASE DO SOMETHING...!</bold></center>');";
}

all that seems to be fine, however when viewing the source code (CTRL+U) the browser shows the "bootstrap.php" part as a link, if clicked it obviously redirects to http://mydomain/bootstrap.php and the js code can be easily seen, which is exactly what i don't want...

So my question is, is there any php-way to know if the file is being loaded from browser's "rendering view" or being loaded from browser's "source code view" ???

Any help is truly appreciated =)

CABP
  • 17
  • 6
  • no, you cant hide the js(html etc) if you want the browser to be able to use it. –  Nov 22 '11 at 23:19

6 Answers6

1

and the js code can be easily seen, which is exactly what i don't want...

You don't want the JS to be seen, but you do want to use it???

There IS something wrong with your code though if you want the js file to be used in your page.

You need to include / require the file:

<script type="text/javascript" language="javascript" src="<?php include bootstrap.php ?>"></script>

Otherwise the browser will load the contents of the bootstrap file, but you want to run the code inside it (which can only be done at the server).

Also:

change:

include('bootstrap.js');

to

echo bootstrap.js;

EDIT

by re-reading your question (and other answers) that's exactly what you want: make your JS code invisible (correct me if wrong).

The answer to that is: No cannot be done.

You can try to obfuscate the code but it will take someone who wants to see it seconds to 'decode'.

PeeHaa
  • 71,436
  • 58
  • 190
  • 262
  • you're right it can't be invisible, the only thing i want is to not load it when viewing source code, i don't mind if users use other tools like firebug b/c i'm using the bootstrap.js file to dynamically insert the really necessary js files according to current url =) – CABP Nov 22 '11 at 23:44
  • It will always be available when viewing the source and there is nothing you can do about it. Well of course you can just choose not to use javascript at all on your page :) – PeeHaa Nov 23 '11 at 00:02
1

In short, no. You can't hide your script source from your users. The best you can do is obfuscate it using tools like YUICompressor.

Demian Brecht
  • 21,135
  • 5
  • 42
  • 46
  • I agree, I'm thinking however, if the source code shows the bootstrap.php as a link and I click it it means that it'll load the file regardless if it's been loaded before or not – CABP Nov 22 '11 at 23:29
1

There's no way you can hide the javascript code. It needs to be executed by the client, and even if you try to hide it by formatting your code badly, tools like firebug can easily introspect the code and pull out the code.

F21
  • 32,163
  • 26
  • 99
  • 170
  • I can live with firebug and stuff like that, all my clients are very basic users so i'm 100% sure they don't use tools like that... – CABP Nov 22 '11 at 23:33
  • 1
    @CABP: If they know what JS looks like / want your JS they will have some form of dev tools in their browser. I'm 99.99999% sure of that. – PeeHaa Nov 22 '11 at 23:34
1

To be honest I don't think you can actually hide it like that. I'm assuming the best thing you've got to go on is the useragent string but I'm assuming if you "view source" in a browser it would still send the regular headers.

The only way I can think of adding the JS include without it appearing when in view source mode is to actually load the external file via javascript (you could even break the path of the js file into variables so it isn't really human readable) which I would not advise.

If someone wants to get at your javascript they will there no is way of avoiding it.

rmorse
  • 736
  • 6
  • 18
0

I'm really sorry for disappearing from here... The best solution I decided to implement is quite simple: don't show ANY URL or PHP files within JS code; so during last months I've used a unique PHP file to do all necessary database queries, a stored procedure generates dynamically all the URL's needed from JS. In that way URL's vary every time and what I've named "poor logic" goes free for users to view/copy I don't mind that while server data is secure.

THANKS ALL FOR YOUR VALUABLE ANSWERS!!!

CABP
  • 17
  • 6
0

Try using the $_SERVER["HTTP_referer"], which have the url that called this file.

DiogoDoreto
  • 883
  • 4
  • 16
  • well, if the referer is the _"home" page_ than show the code, otherwise don't – DiogoDoreto Nov 22 '11 at 23:30
  • @DiogoDoreto mmmm not sure about that, php website says that http_referer can not be trusted... – CABP Nov 22 '11 at 23:39
  • yes, it can't be trusted, but you can't hide a client side javascript code either... Only who knows how to fake a server var will see the code (or inspecting on browser) – DiogoDoreto Nov 22 '11 at 23:49