Hide php file name from url

Samy86 · Jul 30, 2015

Hi guys!

Some developers used to hide php file name from url to prevent possible attacks. by hiding php file name the attacker does not know which programming language you have used to build pages. for example http://mydomain.com/staff/details.php?staffid=2903&fullname=TorstenSeeger would be changed to http://mydomain.com/staff/2903-TorstenSeeger
Now my fist question is how to build such pages and grab url info from?

The second one is how to create pages to show urls like as http://www.gsmarena.com/motorola_moto_x_style-7229.php which "motorola moto x style" is the name of product and 7229 is product id in gsmarena?

Thank you in advance

Weedpacket · Jul 30, 2015

First of all, URLs are not file names (or file paths), and really it's only laziness and convenience that sees [noparse]http://www.example.com/foo/bar/baz.ext[/noparse] being mapped to the /www/foo/bar/baz.ext file. URLs should be designed for the convenience of people using them.

How you configure your web server to do the mapping differently depends on what web server you use. Apache, for example, has modules such as mod_alias and mod_rewrite for mappings of various degrees of complexity. To rewrite [noparse]http://www.example.com/staff/2903-TorstenSeeger[/noparse] into [noparse]http://www.example.com/staff/details.php?staffid=2903&fullname=TorstenSeeger[/noparse] would be something resembling (and obviously I haven't really done this particular task because don't know all your requirements or have your job):

RewriteBase /staff/
RewriteRule "^([0-9]+)-(.*)" "details.php?staffid=$1&fullname=$2"

The answer to the second question is the same as the answer to the first; use URL rewriting to rewrite the URL.

Samy86 · Jul 30, 2015

Thank you for the reply

Here is a simple example of what I am going to do:

<?php

echo "<table width=\"200\" border=\"1\">";

mysql_connect("host","user","pass");
mysql_select_db("dbname");

$fetdat = mysql_query("SELECT faculty_id, faculty_fullname, faculty_nationality FROM faculty WHERE faculty_interests LIKE '%IMP%'");

while($fetarr =  mysql_fetch_array($fetdat)) {
	$fid = $fetarr['faculty_id'];
	$fname = $fetarr['faculty_fullname'];
	$fname = str_replace(" ", "-", $fname);
	$fnat = $fetarr['faculty_nationality'];
	echo "<tr>
    <th scope=col>$fid</th>
    <th scope=col><a href=facdets/".$fid."-".$fname."-".$fnat.">".$fname."</th>
    <th scope=col>$fnat</th>
  </tr>";
}

echo "</table>";
?>

that would display a huge amount of data like this:

when I open http://localhost/facs/facdets/2548-George-Wolberg-US I need to grab url information for example extract 2548 which is staffID and search for details in db. How can I write such a code?

thanks

Samy86 · Jul 30, 2015

Thank you for the reply

Here is a simple example code of what I try to do:

<?php
echo "<table width=\"200\" border=\"1\">";

mysql_connect("host","user","pass");
mysql_select_db("dbname");

$fetdat = mysql_query("SELECT faculty_id, faculty_fullname, faculty_nationality FROM faculty WHERE faculty_interests LIKE '%IMP%'");

while($fetarr =  mysql_fetch_array($fetdat)) {
	$fid = $fetarr['faculty_id'];
	$fname = $fetarr['faculty_fullname'];
	$fname = str_replace(" ", "-", $fname);
	$fnat = $fetarr['faculty_nationality'];

echo "<tr>
<th scope=col>$fid</th>
<th scope=col><a href=facdets/".$fid."-".$fname."-".$fnat.">".$fname."</th>
<th scope=col>$fnat</th>
  </tr>";
}

echo "</table>";
?>

that would disply a huge amount of data like this:

Now when I open http://localhost/facs/facdets/2548-George-Wolberg-US I need to extract 2548 and using that I search inside db. How can I write such a code?

dalecosp · Jul 30, 2015

Weedpacket;11049767 wrote:
The answer to the second question is the same as the answer to the first; use URL rewriting to rewrite the URL.

Hear hear ... the canonical advice from the master.

Perhaps worth mentioning a second-place contender: Apache can also be configured to serve file without extensions, or with any extension, as some other type, using directives like ForceType or SetHandler.

dalecosp · Jul 30, 2015

Samy86;11049769 wrote:
Thank you for the reply

Here is a simple example of what I am going to do:
<?php

echo "<table width=\"200\" border=\"1\">";

mysql_connect("host","user","pass");
mysql_select_db("dbname");

$fetdat = mysql_query("SELECT faculty_id, faculty_fullname, faculty_nationality FROM faculty WHERE faculty_interests LIKE '%IMP%'");

while($fetarr =  mysql_fetch_array($fetdat)) {
	$fid = $fetarr['faculty_id'];
	$fname = $fetarr['faculty_fullname'];
	$fname = str_replace(" ", "-", $fname);
	$fnat = $fetarr['faculty_nationality'];
	echo "<tr>
    <th scope=col>$fid</th>
    <th scope=col><a href=facdets/".$fid."-".$fname."-".$fnat.">".$fname."</th>
    <th scope=col>$fnat</th>
  </tr>";
}

echo "</table>";
?>
that would display a huge amount of data like this:

when I open http://localhost/facs/facdets/2548-George-Wolberg-US I need to grab url information for example extract 2548 which is staffID and search for details in db. How can I write such a code?

thanks

Looking at that URL, is "facdets" a PHP script?

If you can get that working, a cheap hack might be:

$path = parse_url( $_SERVER['REQUEST_URI'] );
$raw_string = $path ("path");
$raw_string = explode("/", $raw_string);
$staffID = intval($raw_string[2]);

Samy86 · Jul 30, 2015

"facdets" is a subdirectory, inside factdets I have index.php I need to write the code inside index.php and when the user opens http://localhost/facs/facdets/2548-George-Wolberg-US , index.php to be executed. is that possible!?

this error occurs when I open the link which is rational because the url is not available but how can I handle it?

dalecosp · Jul 30, 2015

Samy86;11049777 wrote:
"facdets" is a subdirectory, inside factdets I have index.php I need to write the code inside index.php and when the user opens http://localhost/facs/facdets/2548-George-Wolberg-US , index.php to be executed. is that possible!?

this error occurs when I open the link which is rational because the url is not available but how can I handle it?

You must do as suggested above; either use mod_rewrite to make all requests in that subdir point to index.php, or delete the subdir and make "facdets" a PHP script, then use ForceType or SetHandler....

dalecosp · Jul 30, 2015

Here's a thread that deals with this, more or less: [thread=10258995]Search-Engine-URL-Trick-Code-By-Tim-Perdue[/thread]

Samy86 · Jul 30, 2015

Thank you very much dalecosp, that was very usefull! I think it would be better to rename topic name to "Search engine friendly URLs"

Other members may also have a look at these pages:
http://www.the-art-of-web.com/system/rewrite/1/
http://www.sitepoint.com/search-engine-friendly-urls/
http://www.seochat.com/c/a/search-engine-optimization-help/creating-search-engine-friendly-urls-with-php/
http://www.visualscope.com/seo-friendly-urls.html
http://www.9lessons.info/2011/04/seo-friendly-urls-with-php.html

dalecosp · Jul 30, 2015

Samy86;11049783 wrote:
Thank you very much dalecosp, that was very usefull! I think it would be better to rename topic name to "Search engine friendly URLs"

You might be correct, but, given that this is a forum, the thread is an historical post over 10 years old, and the thread title mentions Tim Perdue, I doubt anything along those lines would happen.

Samy86 · Jul 31, 2015

dalecosp;11049785 wrote:
You might be correct, but, given that this is a forum, the thread is an historical post over 10 years old, and the thread title mentions Tim Perdue, I doubt anything along those lines would happen.

I mean this topic, not the other one.

Hide php file name from url

SSamy86

Weedpacket

SSamy86

SSamy86

dalecosp

dalecosp

SSamy86

dalecosp

dalecosp

SSamy86

dalecosp

SSamy86