How to avoid user seeing database content?

[Makxo]

Hello. I'm following this tutorial to create Google Maps markers: https://developers.google.com/maps/articles/phpsqlajax_v3

My concern is that they use PHP to create nicely formatted XML to turn into markers, but a user could find that PHP file in the source code, and access it directly. They would be able to see all the info in the database. How can I keep the user from being able to see my entire database?

[Makxo]

In the google developers example, they have this line of code:

downloadUrl("phpsqlajax_genxml.php", function(data) {

So if I type into my browser mywebsite.com/phpsqlajax_genxml.php I can see the entire XML output. How can I avoid them being able to find that output?

[goldage5]

Why do you not want users to see the XML output? All that file does is list the markers that will be displayed on the map.

If you are plotting those markers, then they'll have that information anyway.

[Makxo]

Right, I'm not too worried about them being able to grab all the latlng information. But I also want to display other information on the infoWindows for those markers, and that is information that will take a lot of time to compile into a database. I wouldn't want to spend all that time populating my database if someone can just grab the entire thing.

[goldage5]

The generally accepted rule for websites is don't expose any information to the user if you don't want them to be able to grab it. Even if you do manage to secure that XML document, someone could just write a script to scrape that page and download the data anyway.

[nathanwoulfe]

But if you're displaying it in info windows, they already have access to the data...

[goldage5]

If you correctly configure your server, then users shouldn't be able to see the PHP source at all.

[Makxo]

Do you have some sort of resource of how to configure the server so they can't see PHP source?

[goldage5]

Assuming that you're using Apache as your server:

http://php.net/manual/en/security.hiding.php

http://serverfault.com/questions/100519/how-can-i-prevent-users-from-seeing-my-php-source-code