How To Hide Url From Users When Submitting This Form?

I have a form with many many fields... When submitting these fields, I use the POST method which hides the actual variables passed along to the PHP page. However, I can't get rid o

Solution 1:

When submitting a from you have to specify a action attribute for the form. I assume that your action is mydomain.com/bin/query# but you want it to be mydomain.com/search. Then you should use mydomain.com/search withing the action attibute and the following rewrite:

RewriteEngine on 
RewriteRule ^/search$ /bin/query [QSA,NC]

That would show mydomain.com/serach in the browsers URL.

EDIT: Using the QSA flag you can pass GET paremeters to your query script. The NC makes the rewrite case-insensitive.

Your form should look like this:

<formaction="/search"method="post">
...
</form>

Solution 2:

You shouldn't hide the URL, it is a waste of time.

The user's browser (which is under the control of the user) sends data to your server. Users will always be able to send whatever data they like to the form handler (since you can't tell the browser where to send it without making that information available to the user). Using mod_rewrite just changes the URL (so there is no security benefit from hiding it) and search engines don't make POST requests (so there is no SEO benefit).

If you are looking for a cosmetic benefit, then I really wouldn't worry about it. The number of users who would notice the URL the form submitted to is tiny, and the number who care is even smaller.

Solution 3:

Supposing you're new in the web world, here is 2 rules for you to learn:

1. According to HTTP standard, search must be done using GET method, not POST
2. Hiding url is a nonsense. Though you can use mod_rewrite to beautify the URL, not to "hide" it.
3. Hiding search variables is a nonsense, with no excuses. search must be done using GET method, not POST

Solution 4:

Try RewriteRule ^/search /bin/query then you can change your form action to /search

Solution 5:

What you can do is issue a redirect following your form processing.

// process form vars e.g.,
save_values($_POST);
// redirect
header('Location: /some/other/page');
exit;

Browser users will only see the page you eventually redirect too. It will still be possible to inspect the HTTP requests/responses to determine the location of the form processing if you know what you're doing.