Log in

View Full Version : how protect external javascript using PHP


M rosi
07-26-2010, 04:14 PM
hi,

I want to protect my external javascript(and css also) from outside people, who steal my javascript.


but this is impossible using client-side language.


so can anyone tell me a method to hide external javascript(and css) by using sever-side language???


thank you
bluewalrus
07-26-2010, 04:28 PM
You can not as was already stated in the other post.
madu
07-26-2010, 05:00 PM
why ?
bluewalrus
07-26-2010, 05:16 PM
Why cant you or why would you want to?
M rosi
07-26-2010, 05:28 PM
bluewalrus, what do you mean "other post" ???
bluewalrus
07-26-2010, 05:46 PM
http://www.dynamicdrive.com/forums/showthread.php?t=56078
M rosi
07-26-2010, 05:51 PM
I found some code. but it' not working
the code witch i want to protect

<html>
<head>
<title>Test</title>

<link rel="stylesheet" type="text/css" href="Excss/css_test.css"> //external css in the folder of Excss
<script type="text/javascript" src="Exjs/js_test.js" ></script> //external js in the folder of Excss
</head>
<body>
</body>
</html>


then the new code....
my.html


<html>
<head>
<title>Test</title>

<link rel="stylesheet" type="text/css" href="hide.php?type=css&serve=css_test"/>
<script type="text/javascript" src="hide.php?type=js&serve=js_test"> </script>

</head>
<body>
</body>
</html>

hide.php

<?php
if (defined('IN_SITE'))
{
$sPath = '';
switch(@$_GET['type'])
{
case 'css':
header('Content-type: text/css');
$sPath = 'Excss/' . @$_GET['serve'] . '.css';
break;
case 'js':
header('Content-type: text/js');
$sPath = 'Exjs/' . @$_GET['serve'] . '.js';
break;
}

// sPath should be a non-published directory
$fp = @fopen($sPath, 'r');
if ($fp)
{
fpassthru($fp);
fclose($fp);
}
}

?>

why is this not working? can anyone correct this code.....?
M rosi
07-26-2010, 06:00 PM
oh dear! oh dear! that post was mine!!! :D
since i didn't get a solution, i decide to post it under PHP. so this is not a "other post". that's mine..........
so bluewalrus, you can help me to solve my problem at-least looking at above code.please.... :)

thanx.... hope you all will help me.
bluewalrus
07-26-2010, 06:11 PM
That's not going to hide the code or protect it. The user just needs the variables which are and have to exposed in your code.

Anyway if you want to do it the way your doing it can you post a link or the directory structure, just note that it is not anymore secure than linking to the regular css file.

or you could try



<?php
if (defined('IN_SITE'))
{
$sPath = '';
@switch($_GET['type'])
{
case 'css':
header('Content-type: text/css');
$sPath = "Excss/$_GET['serve'].css";
break;
case 'js':
header('Content-type: text/js');
$sPath = "Exjs/$_GET['serve'].js";
break;
}
// sPath should be a non-published directory
$fp = @file_get_contents($sPath);
if ($fp) {
echo $fp;
}
}
?>
M rosi
07-26-2010, 06:57 PM
thnax for responding me.
but it's not working bluewalrus....
should it be implement a centralized session management???
bluewalrus
07-26-2010, 07:06 PM
Try

<?php
error_reporting(E_ALL);
ini_set("display_errors", 1);
echo "start<br />";
if (defined('IN_SITE')) {
echo "in site";
echo "$_GET['type']";
$sPath = '';
switch($_GET['type']) {
case 'css':
echo "in css";
header('Content-type: text/css');
$sPath = "Excss/$_GET['serve'].css";
break;
case 'js':
echo "in js";
header('Content-type: text/js');
$sPath = "Exjs/$_GET['serve'].js";
break;
}
echo "out of case $sPath was set?";
// sPath should be a non-published directory
$fp = file_get_contents($sPath);
if ($fp) {
echo $fp;
}
}
?>


Post back any error message or what the output is.
M rosi
07-26-2010, 07:30 PM
via this code no out put at all(no error message).
other parts are working.it seems to be, there is no css & no JavaScript.
traq
07-26-2010, 07:46 PM
are you trying to prevent hotlinking (other sites linking directly to your files, on your server, for their own use) to your javascript/css?

>> you can prevent hotlinking using .htaccess (http://www.google.com/search?q=hotlinking+.htaccess&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a)

or, do you want to prevent people from being able to see/copy your javascript/css?

>> that's impossible (http://www.dynamicdrive.com/forums/showthread.php?t=48916).
madu
07-26-2010, 07:58 PM
try this,

<html>
<head>
<title>Test</title>

<?php

session_start();
$_SESSION['insite'] = true;

function quitInsite()
{
unset($_SESSION['insite']);
}

if (!defined('SHUTDOWN_REGISTERED')) // *_once, this shouldn't be necessary
{
register_shutdown_function('quitInsite');
define('SHUTDOWN_REGISTERED', true);
}

?>

<link rel="stylesheet" type="text/css" href="hide.php?type=css&serve=css_test"/>

<script type="text/javascript" src="hide.php?type=css&serve=js_test">

</head>
<body>
</body>
</html>



<?php
session_start();

if (isset($_SESSION['insite']))
{
$sPath = '';
switch(@$_GET['type'])
{
case 'css':
header('Content-type: text/css');
$sPath = 'Excss/' . @$_GET['serve'] . '.css';
break;
case 'js':
header('Content-type: text/js');
$sPath = 'Exjs/' . @$_GET['serve'] . '.js';
break;
}

// sPath should be a non-published directory
$fp = @fopen($sPath, 'r');
if ($fp)
{
fpassthru($fp);
fclose($fp);
}
}

?>
M rosi
07-27-2010, 02:39 AM
thanx for help me.
it is not working again. should it be with session! however it is not working dear!