I understand that scripting language such as PHP will not be shown in the page source of the browsers. Is it not the same for JavaScript?

If so, why are they treated differently and are there solutions available to hide JavaScript from page source (revealed by browser)?

I don't need the details about how exactly to hide it, just out of my curiosity if it has been worked on.

Thanks!

I understand that scripting language such as PHP will not be shown in the page source of the browsers. Is it not the same for JavaScript?

If so, why are they treated differently and are there solutions available to hide JavaScript from page source (revealed by browser)?

I don't need the details about how exactly to hide it, just out of my curiosity if it has been worked on.

Thanks!

• javascript

• 6 Javascript is a browser-side language, so yes, the source code needs to be available to the client. There are obfuscator solutions but none that can pletely hide the code. – Pekka Commented May 30, 2012 at 16:38
• JavaScript is script executed by the browser, so the browser needs to be able to see it. PHP (or C#, etc) is run on the server to generate the page before ever sending it to the browser, so the browser never sees it. – yoozer8 Commented May 30, 2012 at 16:39
• Note that this thus means that you shouldn't do business sensitive things like as validation solely in JS, but also do it in server side. JS should generally only be used to enhance user experience. – BalusC Commented May 30, 2012 at 16:41
• thanks all, now it all make sense. – eastboundr Commented May 30, 2012 at 19:56

7 Answers 7

PHP is run on the server and produces some output, often HTML, but may also include XML, CSS, PHP, images etc.

JS gets sent to the client, and is run there, so they need to see it.

You can always view JS source, though you can obfuscate it. There isn't much point though, as a decent debugger will let you work things out anyway.

For instance, using the Web Inspector in Webkit browsers, or Firebug will allow you to view the javascript and set breakpoints and see variable values, so it's often trivial to work out what is going on.

This is OK though, and it one of the reasons why learning JS is so straight forward. When designed correctly, it's rare that this presents a security problem.

You may find sites where the JS looks mangled and unreadable - this is frequently done to reduce the file size, hence all the .min.js files you see on websites rather than to make it hard to read.

Most people do this automatically as part of their build process, rather than doing it by hand. To do this, https://github./mishoo/UglifyJS is a good choice.

You should understand that there are server-side and client-side scripting languages. What you see on the client (browser) is the output of execution of the server-side script (PHP, Perl etc).

That said, there have been libraries developed to obfuscate JavaScript code.

PHP isn't "shown" in the browser because it's not there: it's already been rendered as HTML and sent to the browser by the server. (Same as Java servlet or JSP code.)

In-line JavaScript is part of what's sent to the browser, so it can be shown in page source.

JavaScript source linked in a <script> tag is not shown as part of page source; you only see the tag and the URL.

I understand that scripting language such as PHP will not be shown in the page source of the browsers. Is it not the same for JavaScript?

Yes, server-side script is not visible in the browser's source though client-script like JavaScript is fed to and parsed by the browser.

If so, why are they treated differently and are there solutions available to hide JavaScript from page source (revealed by browser)?

"Hiding" JavaScript isn't possible. Though, you can minify and obfuscate the script.

http://en.wikipedia/wiki/Minification_(programming)

http://en.wikipedia/wiki/Obfuscation

No, you need to distinguish between serverside and clientside (scripting) languages.

A serverside script runs invisible [from the client] and sends its results (of any type, including js files) to the browser. These result files are public.

A browser receives public files. Some of them can and will be executed. As JavaScript is a non-piling language, you will always see its source.

See also How to prevent View Source of page using Javascript?, how to hide javascript code etc. - you only can obfuscate it.

Javascript and PHP are two different concepts one of them is client side language which can be seen in browser and the other server side which is hidden to the eye.

One simple way to hide your javascript code would be to include in a file so it wouldn't be seen in that specific page - but everyone will have a link to it and can still see it when they click on it.

Other solution would be to minify it, which would work the same but is going to be petty much unreadable.

http://en.wikipedia/wiki/Minification_%28programming%29

PHP is like a macro running on the server, it outputs text that is sent to the client. JS is scripting that the browser must interpret to update the contents of the page.