php do not show html if called directly

Hello everyone,

I'm working on something and I need a little bit of help..

So the issue.... I need to protect some javascript code that is generated on thy fly by php in 2 steps

1) If some one call www.site.com/jscode.php the script will not show anything but if is called like <script src="www.site.com/jscode.php"> to show the javascript.. Any clue how I can do that... ?
2) javascript code will be obfuscated on the fly using http://dean.edwards.name/download/#packer php version ..and here another question arise.. Will some antiviruses detect something like function(p,a,c,k,e,r).....unreadable code as malicious code ?!?

Thanks and looking forward for your answers

No, they most likely will not call it as a virus.

for 1) ok did some testing and the only difference in headers i can find is this

called directly

called with javascript


do you think I can rely only on this ?

Okie I've solved my issues. If anyone is interested I will post the solution here

First of all I check if the referrer is blank..If it is then the file is called directly and someone want to take a peek on my js code so I show nothing

You may also show some dummy javascript which the viewer will copy it and will get mad thinking why is not working

Secondly I encript my javascript on the fly using an open source packer


This should keep most of the common eyes far away from your dirty tricks as can be used for CS, fake traffic ,fake votes etc etc :batman:

If this is mission critical then you're shooting yourself in the foot by using the referrer. There are plenty of plugins for FF that block, change, fake or randomize the referrer at will.

What I'd probably do to stop casual snoopers is load the JS with an encoded piece of ajax after the page loads and only return the true script if some time-key and quick encoded var check is passed. Basically call your ajax script with a dynamically created url var, encoded timekey+userip+requesturi (or something similar) on each page load. Just check this is valid in your php script and output what you like depending on the results.

Well what SpamHat seems more viable to me... but theres no fool proof method to save your javascript code anyways... i tried it earlier... but as you know it, whatever is made, can be broken (except php of course, no way that someone can get your php code)