How do I make a bridge code between my javascript file and php file to protect MySQL info's?

Question

I have four files.

index.php "the main page" with search function that use MySQL databse. and I call the database throw javascript, client side.
fetch.php "contain MySQL connections info's.
bridge.php to cover fetch file, and I'm using php code to make the connection.
.htaccess file to block any direct access to the fetch.php file.

index.php<--->bridge.php<--->fetch.php<--->Mysql

My index.php file contain this code below, and because I'm using JavaScript! .htaccess file blocked index.php file from accessing my fetch.php file, javascript is "client side"

<script>
$(document).ready(function(){

    function load_data(query)
    {
        $.ajax({
            url:"bridge.php",
            method:"post",
            data:{query:query},
            success:function(data)
            {
                $('#result').html(data);
            }
        });
    }

So I made my javascript code call the bridge.php file, and the bridge.php file call the fetch.php file throw PHP language, to make all this work.

So my bridge.php file code:

<?php
include 'fetch.php';
?>

Now no one can access fetch.php directly .htaccess file block any direct connection throw the browser but if I call the file bridge.php throw the browser it will open the database! that's doesn't solve anything! what I'm doing wrong?

This is the code of my .htaccess file:

<Files ~ "fetch.php">
  Order deny,allow
  Deny from all
  Allow from 127.0.0.1
</Files>

And this is how my fetch file call MySQL:

$connect = mysqli_connect("localhost", "example.com", "passowrd", "databasename");
$output = '';
if(isset($_POST["query"]))
{
    $search = mysqli_real_escape_string($connect, $_POST["query"]);
    $query = "
    SELECT * FROM tbl_customer 
    WHERE CustomerName LIKE '%".$search."%'
    OR Address LIKE '%".$search."%' 
    OR City LIKE '%".$search."%'

Tigger · Accepted Answer · 2019-04-19 02:39:43Z

1

I think you are overcomplicating the issue or you have composed fetch.php in a way that does not help.

I'm guessing your fetch.php has MySQL functions or class code in it that you then access and use. Something like:

<?php

define('MYSQL_SERVER','localhost');
define('MYSQL_LOGIN','mylogin');
... and more ...

class DB {
   ... methods ...
}
?>

The key part of fetch.php should be the opening <?php and the closing ?>.

If you (or anyone else) directly requests fetch.php, your code should be written in a way that the result is a totally blank page.

The only overhead on the web server is the single PHP pass that will then render the blank return to the browser.

If you have written your code in another way I suggest you rethink your approach and question why you have done what you have.

BTW, adding details to a .htaccess file should only be done if there is no other way. As far as web server preformance, they are not a good idea.

Edit:

If you really want to make sure fetch.php is not directly called but only ever included in another file, you could do something like the following right at the top:

<?php

if (count(get_included_files()) == 1) {
    // direct request, do nothing
    exit;
    // or even redirect somewhere like
    header("Location: /");
    exit;
}

// has been included, allow rest of script to process
$connect = mysqli_connect("localhost", "example.com", "passowrd", "databasename");
// ... more code below

edited Apr 19, 2019 at 2:39

answered Apr 19, 2019 at 1:59

Tigger

9,1485 gold badges40 silver badges40 bronze badges

Sign up to request clarification or add additional context in comments.

8 Comments

Someone Over a year ago

I got it, is there anyway to make my code inside fetch.php file only accept connection "or being opened" from index.php and about the bridge file, it was someone advice, bad advice...

Someone Over a year ago

I Included my fetch file code, I tried your method, but it still the same, I put it at the top of my code

Tigger Over a year ago

@Someone : Make sure your code is the same as the latest edit. If if still have fails, what does var_dump(get_included_files()) show you?

Someone Over a year ago

Still can access the file directly, and also I edit the code with this one var_dump(get_included_files()) and still can access the page directly

Someone Over a year ago

Okay now I solve it, it's work like what you exactly said, when I open the fetch file direclty, blank page, but now index.php can't access the database at all

|

Collectives™ on Stack Overflow

How do I make a bridge code between my javascript file and php file to protect MySQL info's?

1 Answer 1

8 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

8 Comments

Your Answer

Sign up or log in

Post as a guest

Related