我可以在jquery脚本中隐藏帖子页面名称吗？

Question

Can i hide process.php page name from this script. I mean can I send data to another page in other secure method so that client can not see the page name, I think it is not that secure for a professional/commercial website.

function sess(x) {
     var x;                     
     jQuery.ajax({
         type: 'POST',
         url: 'process.php',
         data: {
                 y: x                       
               },                   
         success: function (html) {
                    $(".msg").html(html).show();
                  }
     });
     setTimeout(function(){$('.msg').hide();}, 2000);
}

Answer 1

The short answer is, NO.. there is no way to completely hide the name of the page you are posting to. The browser must know where to POST your data to.

However, just because the user knows of the existence of a specific page, doesn't mean they should be able to exploit it. You can take some measures to protect yourself.

• Don't echo or print any superfluous information in your process.php page. This includes error messages..!

• Only echo the minimum response needed by your Javascript. Sometimes a response may not be needed. While other times just an OK will suffice, other times just a TRUE or FALSE will work. Of course sometimes you will need to return data or full objects.

• You could generate a random value and store it in a cookie and include it with every AJAX request. Then, you can validate on the server side and only output data if that value is valid.

Ideally, you want the user to see absolutely nothing if they navigate to your process.php page.

Hope that helps..!