Question

I am using linux cpanel shared hosting.

Am using http://aaa.com/script.php to scrape data from other website.

PHP portion is to curl call to read whole page content, then on the page, will output the full content as html, then use jquery scrapping & ajax call to insert final data into mysql.

(I decided to go for jquery client side scrapping because the page with html to scrap is pretty complicated, and hard to achieve with phpsimpledom and regex.)

I want this page to stop outputting html when it is
– not open by me as a tester
– not open by local cpanel cron task.

So I put exit(); at the top few lines.
If detected is legitimate, then will continue the rest of the html outputs at bottom, else, just exit and show an empty page.

Now is security issue, what’s the possible and best way for me to make sure other visitors/bots to this page will see empty page.

If I put a password to cron task, I don’t think it can work right?
Because at script.php I am scrapping data, so if the website owner see the visitor referral log, he can see the full url including ?password=12345, isn’t it.

/usr/local/bin/php -f /home/mysite/public_html/dir/script.php?password=12345

If I put my script outside of public_html, like /usr/local/bin/php -f /home/mysite/script
I don’t think it will work for jquery, it is purely for php isn’t it?

What else I can do??

Answer 1

Passwords on the query string are a bad idea. You could check for valid IP addresses at the start of your PHP file. This will allow any request from a set of IP addresses to access the parsed jQuery output. All other IPs will be denied access.

$allowedIps = array('127.0.0.1','::1');
if(!in_array($_SERVER['REMOTE_ADDR'],$allowedIps)){
    echo 'No jQuery for you';
}else{
    echo 'jQuery goodness to follow...';
}