[RESOLVED] don't want to show page address or links in browser

jahlmann

When the mouse hovers over a link, the browser displays the link. I don't want to show the link. When the user clicks on the link and the new page is displayed, the address is displayed by the browser. I want the original address, i.e. abc.com to stay in the address bar. I don't want to show i.e.: abc.com/customers.php

I know it can be done with "frames". However, this would take a big effort to change the entire system over.

Is there a simple php script that I can use to suppress the showing of the address.

Bonesnap

I do not think it's possible to prevent the browser from displaying the URL of the a link when you hover over it. Really when you think about it, it's a security issue because you could have a link that says "Click to redirect to the home page" but really it links to download_awesome_virus.exe", or loads up a mangled image, or redirects to a malicious page, etc. However, with that said, if this was possible, it would have to be taken care of client-side (in most likely JavaScript), so PHP is not the tool you are looking for.

What you could do is have an <a> tag with an empty href attribute, but then add a click event to it (would probably need to assign it an ID or some kind of identifying class) to inject a predetermined URL into the href attribute and then redirect to said address. Or simply just redirect the user to said address (so you wouldn't even really need an actual <a> tag).

I would advise against this though, for the reason mentioned in the first paragraph. It's a usability issue and I can say right now if I were to go to a website that intentionally tried to hide its URLs I would think something shady was going on and would leave pronto.

As for hiding the URL in the address bar, I believe you can do this in an .htaccess file (again, PHP is not the tool to accomplish this), but I am not an expert with .htaccess files so I wouldn't know any specific code. Doing some searching online should be able to yield you with decent results though.

Is there a particular reason you're trying to hide the URLs so badly? If your issue is you don't like the file extensions you can definitely remove them via .htaccess (so www.example.com/about-us.php becomes www.example.com/about-us). Pretty sure this would also help with your SEO, if you care about that.

jahlmann

Thanks for your answer.

Yes, there is a particular reason for this. I am running an online driver education course. When a student has finished the course, I notify the driving school (via email) so they can sign-up the student for Behind-The-Wheel lessons. That's where the schools make their money. It appears, that somewhere along the line, some other driving school can find out that the student has finished and has contact information, i.e. phone, address etc. They now call the student and try to sign the student up for BTW.

Bonesnap

Could you describe the process/workflow of this site? I'm not sure how this sort of stuff would be public for a third party to glean info from it.

jahlmann

I will write you the details a bit later today - long story. I need to go to town now and don't know when I will be back.

Bonesnap

jahlmann;11051319 wrote:
...and don't know when I will be back.

You're not taking a jet plane, are you? 🙂

jahlmann

taking a jet plane? No, just a Zug nach nirgendswo! (old German song).

OK, back to the problem at hand. The student goes to my customer website. Clicks on "login" which takes him to MY login page i.e. https://course.dmv-driversed.com/something.php I now set some cookies to keep track of the student and where he comes from. The student has to answer 6 biometric questions first. After that, he has to login and answer 2 biometric questions. He now goes into the course. After each section/lesson the student needs to click on a link that executes a couple of php scripts that record data on the MySQL database. When the student is finished with the course, he needs to fill out a questionnaire and after that he needs to take the final test. If he passes the test, (this is where I think the problem might be) he gets a "congratulation" page. If he continues, a php script is activated that sends an email to the driving school and to myself. Perhaps it is the email that can be intercepted - I don't know. Any suggestions?

The strange thing is that somebody else gets a hold of personal information (name, address, phone#).

Thanks for your help.

sneakyimp

Email is almost universally NOT encrypted in transit, but I seriously doubt that this competing driving school is intercepting these emails and reading them. I think it is probably more likely that the students may receive email at a Gmail or Yahoo or Microsoft account and that these companies, who can easily see the contents of the email, sell lists to marketers. It would be very easy for Google to give marketing companies a list of people interested in "driving school."

I'm not certain, but I believe the cookies you set are not the problem -- one's browser would not send your cookies to YourCompetitorWebsite.com.

The data entered into your server (biometric questions, etc.) should probably be entered into a page hosted via HTTPS -- especially if it is sensitive information. I would definitely host the entire test via HTTPS. In fact, it's more and more common for websites to host EVERY page via HTTPS these days.

jahlmann wrote:
The strange thing is that somebody else gets a hold of personal information (name, address, phone#).

Sadly, companies like Facebook and Google are able to acquire this information. E.g., Gmail asks you for a phone number to "validate" your account. Facebook somehow learned my birthday. There's no privacy any more.

jahlmann

OK, my entire course is hosted on an HTTPS. The email we use, in this particular case, is one from @sbcglobal.net. Yes, I understand that email is not secure any more. As I am also hosting most websites for my customers (for FREE) I will encourage them to use the email address I had set up for them on my dedicated server.

Where in this world is Flanders Fields? Could it be Poirot's home?

Thank you so much for all your help.

sneakyimp

jahlmann;11051383 wrote:
OK, my entire course is hosted on an HTTPS.

This is good for you and your users 😉

jahlmann;11051383 wrote:
The email we use, in this particular case, is one from @sbcglobal.net. Yes, I understand that email is not secure any more.

Your email address is one thing -- people who can read your email can send you marketing materials that pertain to you. But the email used by your customers or users is another. If any of them receive an email that says DRIVING SCHOOL BLAH BLAH BLAH then google/facebook/yahoo/whoever can sell their contact information to a marketer promoting one of your competing driving schools. You do have control over what emails are permitted to use in conjunction with your site (or sites), but it would probably be a poor decision to exclude gmail/yahoo/facebook/etc. because these are very popular. It's more important to make your site easy to use than to jealously defend yourself against competition.

jahlmann;11051383 wrote:
As I am also hosting most websites for my customers (for FREE) I will encourage them to use the email address I had set up for them on my dedicated server.

I'm not sure, but perhaps you are referring to the driving school owners' emails? As I tried to explain, that's not the real problem. If the users of the site (the students) choose to use a gmail/facebook/whatever address, then you have no ability to protect their email from eavesdropping and no ability to prevent google/yahoo/facebook from selling their contact information to a rival organization.

jahlmann;11051383 wrote:
Where in this world is Flanders Fields? Could it be Poirot's home?

I'm actually in Los Angeles. I'm an amateur WW1 scholar of sorts. Flanders Fields are in Flanders of course.

jahlmann;11051383 wrote:
Thank you so much for all your help.

Glad to help. I had a similar problem with a school-related sites. Our customers were colleges. Their customers were students. They hated to pay to have their students use our system only to see advertisements promoting other colleges.

cretaceous

I don't think Google will sell-on specific personal details - it's all anonymised - cookies are another matter.
Is it possible someone has the password to the CMS side so they simply log in and read the emails?
Or a bad employee at the driving school passes on the details and gets paid for it?