隐藏HTML和AJAX中的文件夹名称

Question

Is there any security risk in revealing PHP folder names? If yes, is there any way to hide the folder names that exist within my html hyperlinks and in my ajax code?

Answer 1

Is there any security risk in revealing PHP folder names?

To simply say "no" is a poor answer. The answer should be "it depends". For the most part, revealing folder names is a minimal risk, but depending on the information you're trying to obscure/hide, it may be worthwhile to hide folder names. As @nogad points out, you shouldn't just use obscurity to hide away your potential issues, you should focus on securing the actual application.

For example:

• Are directory indexes enabled? If someone knows a folders name, and directory indexes are on, they will be able to view the contents of that folder on your site, which may reveal certain elements of your site that you wish to remain private.
• Do your folders contain things that could be easily crawled via a robot. There are many scripts out there designed to scrape and look for common things like "admin.php", or "/admin/index.php". Maybe you wish to hide that, to make it harder for hackers to find a script.
• Let's do a for instance. Let's say you have a folder /secretz428, which contains two files. /secretz428/image.php and /secretz428/admin.php. By exposing /secretz428/image.php to your front end users, they may try to dig into this folder, and may happen upon your admin.php. If there is no security on this script (Or it's prone to hacking), you could open up your site to to an attack. The more you obscure from your users, the harder it is for someone to reverse engineer and find exploits in your application.

Is there any way to hide the folder names that exist within my html hyperlinks and in my ajax code?

Sure. One way is to obscure it within a php script. For example:

index.php:

switch ( $_GET['id'] )
{
    case '1':
       include('secret_folder/mysecretscript.php');
       break;
}