Title: Is this php code safe and how to hide the javascript link?
Tags: php;javascript;security
Question: People will be able to see the javascript confirm link in the status bar of the browse. So, is that code below secure enough and how to hide the javascript to DONT show this: 
```javascript:a = confirm('Are you sure you want to purchase this reward?'); if (a) { location.href='./?page=vote&amp;act=rewards&amp;id=8'} else void(0)```

```Script:```

```if ($_SESSION['nVotePoints'] &gt;= $data['nCost']) {
            $url = './?page=vote&amp;act=rewards&amp;id=' . $data['id'];
            $confirm = "javascript:a = confirm('Are you sure you want to use purchase this reward?'); if (a) { location.href='{$url}'} else void(0)";
          $data['URL'] = $confirm;
        }
        else
          $data['URL'] = 'javascript: alert(\'' . stripslashes(Templat181a:6c1c:918f:f3a4:2e8c:61d6:1a08:6b16GetLangVar('VOTE_NEED_VP')) . '\');';

$column[$i++] = Templat181a:6c1c:918f:f3a4:2e8c:61d6:1a08:6b16Load('vote-reward-column', $data);
```

Kind Regards.

Comment: You're using the HTTP GET method to change state of the server (="purchasing reward") and that is a bad practice. State-changing actions should always be called via POST, PUT or DELETE. GET actions can be easily called by bots, crawlers, they are stored in browser history etc.

Comment: In that case it's still vulnerable with CSRF.

Comment: Exposing the javascript does not seem to be a problem. What do you think is insecure with exposing it? What could the user exploit? I think the end point, the script the user will arrive at when clicking the link will do the deduction from an account. In that case all they can "exploit" is pay for something on a guessed link if they manipulate the url. Which will cost them. So, I don't really see the insecurity of this?

Comment: You can obfuscate it and make it look weird and unreadable with a glance but you cannot completely hide a client side script i.e. JS from the client

Comment: Go ahead and screw it up, that will be best learning exercise when you know it screwed up and you have to fix it. Try it

Comment: If I leave it like that is it secure enough ? I don't care if they will be able to see the actual link to the reward but I care if people won't able to exploit something that's why. So ?

Comment: Is it possible to show me how to edit my code, so that I wont screw it up ? I will be really grateful if you can help me with it. I really want to avoid screwing it up.

Comment: I can't since I really don't have a clue and will be completely useless. If you can do it for me. It will be really appreciated. If not, it's okay.

Comment: I know but thats how it is made. Also, only registered users can access the link for purchase reward. I just need to secure the javascript mainly in my script ...

Comment: So, what I should do to prevent this ?

Comment: You shoudl put you javascript in a function, and add it with an event handler to the link, in stead of putting the javascript directly in the href attribute. This way it will not show up in the status bar of the browser when you hover over the link.


Here is another answer: Keep in mind that even if you could hide the JavaScript, this would not be a secure system. Someone can fire up WireShark, IE's F12 Developer Tools, Firefox' Firebug, or Chrome's Developer Tools and see exactly which page things go to, or debug any call that touches DOM, even if your code is complete gibberish.

If you want to secure things like this you can't trust the client, you need to do it on the server. Otherwise someone can write their own code that calls your service, runs no JavaScript at all, and completely bypasses your validation logic.


{'source': 'StackExchangeDataset', 'subset': 'stackoverflow.com', 'metadata': {'AnswerCount': 1, 'CommentCount': 11, 'ContentLicense': 'CC BY-SA 3.0', 'CreationDate': '2013:00:06/16/13', 'FavoriteCount': None, 'PostTypeId': 1, 'Tags': '<php><javascript><security>', 'Title': 'Is this php code safe and how to hide the javascript link?', 'ViewCount': 251, 'id': 17134465, 'user_AboutMe': None, 'user_AccountId': 2899208.0, 'user_DisplayName': 'Nikolai Hope', 'user_Reputation': 29.0, 'user_Views': 16.0, 'user_id': 2486328.0}}