Question

i am implementing a PHP application, i am using AJAX heavily in forms to send and retrieve values. the typical jQuery function i am implementing is

(function($){
$.fn.saveCountry = function(destinationUrl) {
    this.click(function(){
        var formData = $('form').serialize();
        $.ajax({
            type: 'POST',
            url:  'path/to/files/models/directory/process.php',
            data: 'option=savecountry&'+formData,
            success: function(msg){
                if(msg === 'empty') {
                    alert('Required Values Missing');
                } else if(msg == 'DR'){
                    alert('Duplicate Entry Found');
                } else {
                    destinationUrl(msg);
                }
            }
        });
    });
}
}($));

the problem with the above function is it exposes the application structure of my application for example. the object url: 'path/to/files/models/directory/process.php', reveals the information about the directory structure i am using. this is a kind of threat as anyone with the access to console will be able to monitor what is happening with the request and could misuse it. is there anyway i could hide this data from the outside world?

thank you.

Answer 1

Ultimately no.

The user will always be able to find out the URL of the ajax request if they wish to.

It can be as simple as opening up firebug and watching the requests that are made.

What I’d sugest is some kind of URL abstration such as URL Rewriting in order to hide the physical structure of your file system. This way you’ll not have that specific concern about people seeing your URLs.