How do they do that?

[jez]

Hi,

I have noticed that frequently when viewing a page that has been generated by a server-side script (php, asp, coldfusion), the view source option is not available in the browser.

Is this kind of thing intentional or a by-product of something else.

My own php (and other server scripts), dont act in this way, which i find very useful as seeing the output html from a server script helps in debugging.

I personally dont want to do this, but am curious about it.


Many thanks

 

[skiflyer]

You're actually going to want to look into javascript for this, and yes it's very intentional.

But realize this is only a disabling of menu options, it doesn't really hide the source from someone who actually wants to see it.

-Rob

 

[sleipnir214]

And if it is the disabling of a menu item, it will only work for specific browsers, probably only IE.

skiflyer:
Would this ability be found in JavaScript or in VBScript? VBScript sounds like a much more likely candidate to me. Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!

 

[4x4uk]

There are loads of people asking similar questions in the Javascript and HTML forums, with regard to hiding HTML output you can't hide it. The browser needs it to display your page so if you don't want to people to be able to see it don't put it on the web.
It's not a lie if you believe it!

http://www.ne4x4.org.uk/

http://www.ne4x4.org.uk/Ian/

http://www.ne4x4.fsnet.co.uk/beck/

 

[skiflyer]

To be honest, I've always been told Javascript, and I've actually seen code to disable the right click version with javascript (actually it disables all right clicks)

A search for disable view source[\b] in google displays basically all the useful information.

I do agree, VBScript sounds more useful... never been something I cared about so can't say I know... I'm mostly relating 3rd hand knowledge of the topic from discussions I hardly recall.

-Rob

 

[4x4uk]

Javascript will disable right clicks. But the user can always have javascript disabled and therefore the script can't prevent users from viewing your source code if they want to. It's not a lie if you believe it!

http://www.ne4x4.org.uk/

http://www.ne4x4.org.uk/Ian/

http://www.ne4x4.fsnet.co.uk/beck/

 

[jez]

Thanks, although i thought that this was more a server-script issue, as i dont mean disabling context menus, but all possible view source menu items being greyed out.
Admittedly this only happens to me in IE, but it seems to stop me saving a page & viewing the source but does allow the context menu to appear, but the view source option is greyed out.

I wondered if it was a caching directive of come kind.

Thanks for you replies though, this is quite interesting.

As for my own opinion, I think that client side script is always going to be seen, as i have gone through my browser cache before now looking for source code of pages.
On the other hand server-parsed script is never going to be seen (unless you mis-configure your server)...so if you dont want people to get to your source..use a server script. And for images..get them copyrighted if it is that important.


Thanks again,

JEz

 

[JCrou82]

To add my two cents, there are also programs out there that allow you to create your code and then encrypt it so that when someone does a view source, they get a non-sensical string of letters. I'm pretty sure it works with plain HTML but I'm not sure how well it works with script created HTML code.

try this site for an example:

http://www.tagslock.com/tagslock_pro.htm

to make mention, They don't encrypt their code....

 

[sleipnir214]

Looks completely useless to me.

Of the first 5 sites in their "Sites using TagsLock" page, 4 are completely human readable, and one I could extract with a 5 line perl script. Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!

 

[Wullie]

LOL

One thing I want to know, why do none of the makers of these programs ever use them on their own site?

Take a look at the sites offering "hide html source" programs, then view source on that site, it is nearly always human readable which shows that they don't have much faith in their own programs.

Hope this helps Wullie

http://www.freshlookdesign.co.uk

http://www.freshlookdesign.com

http://www.mailtosanta.co.uk

The pessimist complains about the wind. The optimist expects it to change.
The leader adjusts the sails. - John Maxwell

 

[sleipnir214]

That is interesting, isn't it?

Oh, yeah. I forgot one method TagsLock apparently uses. You put an HTML comment at the beginning of the file which reads something like "This source is not human readable", followed by sufficient newlines to scroll the supposedly non-human-readable HTML off the bottom of the source viewer. Puh-lease. P.T. Barnum was right.

The only way to protect your site's HTML and at the same time make the content viewable by the public would be to encrypt the page (not just randomly change letters to &quot;%<hexdigit><hexdigit>&quot; form like TagsLock does) and require that a user install a decrypt engine as a browser plug-in.

That is, of course, if the user's browser provided the right kind of API hooks to allow a plug-in to hand HTML directly to the rendering engine.
Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!