Passing variables from php to javascript (Safely)

Question

I have been struggling with this kind of problem for a while now, and cannot seem to find any information or sample code to transfer some data between PHP and JavaScript. I saw many ways to do it, but not safely. What I mean exactly is , when you transfer some variable data between the systems, it is directly shown on the view-source window of your page, when it is loaded. What need exactly is a way to transfer the data, but silently and safely , so that it won't show up on the user-side when the page is loaded.

So in brief, is there a way to do this, and possible how ?

I have already tried, transferring the data with a XML file, JSON also, straight forward with echo + , or just after the ?> abbreviation in php. But every way I have used so far, is displayed in the source code of the page when loaded .

Answer 1

What you are asking really isn't possible due to the nature of JavaScript and the web. There are ways of obfuscating the data, and hiding it away in xhttp / ajax requests that can only be requested once. But in order to send the data to the client, the client has to be able to read it, meaning that users that know what they are doing (i.e. have FireBug installed and can write JavaScript) can always decode it and see it.

If I were you I'd look at some simple forms of encoding or encrypting JSON (and request the data via ajax/xhttp over HTTPS) this will put off most people but the technically savvy will still be able to work out ways to decrypt the content. However, if the content needs to be 100% secure - from everybody, even the user actually using the site - then you don't want to be sending that data to the client at all.

Basically it boils down to what data you are actually sending? If it's a question of needing the data on the client-side to perform a specific calculation, ask yourself - Is it possible to send only the user input involved from JavaScript back to PHP (via ajax/xhttp) and then have PHP return the answer. That way PHP only ever need access to your sensitive data.