Question

<form action="/path/hello.php" name='myForm' method='post'>
<!--  onChange="ajaxFunction();"  -->
<input type= "text"  name="user" id= "txtname" /><br />
<!-- <input type="text" name="user2" id="txtname2" /> -->
<input type='submit' name = "click"  />
</form>

Noweveryone who looks at my html source code will know where this php file is located and will know how to call it. How can i stop this ?

Answer 1

If you handle the POST request to /path/hello.php properly, it shouldn’t matter whether someone accesses it manually. Just make sure you are checking for things like the existence of $_POST['click'] and any other POST data you expect to exist, clean it, and proceed as normal.

If someone were to call /path/hello.php with spoofed POST data, then how would that be any different than them submitting your own form? There’s no need to modify the script’s visibility.

Furthermore, if your fear is that someone would be able to view the source of your PHP scripts–don’t. The only thing a user would be able to see if they made an HTTP request to your PHP script would be the rendered HTML.

However, even if they could–why wouldn’t you want someone to see your source (of course, barring situations where you might have sensitive configuration data within a PHP file)