0

I am using PHP to write my server side code for my website. What is the best way to prevent someone from scraping my data?

Like in PHP if someone uses file_get_contents() or someone fetches my login form in an iframe element or the data entered in the login form - how can I prevent such things?

I am using PHP 5.47, MySQL, HTML and CSS.

14
  • There is no safe way. You might try to add some JS that checks cookies, screen resolution, referrers etc, but none of those are 100% reliable.
    – Peon
    Dec 5, 2013 at 7:34
  • 1
    There's very little, if anything, you can do to prevent that. What's your real goal?
    – rath
    Dec 5, 2013 at 7:34
  • 1
    A very complicated matter and most of the time not worth your while.
    – Kiruse
    Dec 5, 2013 at 7:34
  • 1
    Even youtube is not able to prevent their videos getting grabbed by websites like keepvid.com etc Dec 5, 2013 at 7:36
  • 1
    If your site publicly displays data, anyone with enough determination can get it in an automated way. A scraper is doing nothing different from a regular user.
    – deceze
    Dec 5, 2013 at 7:36

4 Answers 4

6

I think that being a web-developer these days is terrifying and that maybe there is a temptation to go into "overkill" when it comes to web security. As the other answers have mentioned, it is impossible to stop automated scraping and it shouldn't worry you if you follow these guidelines:

  • It is great that you are considering website security. Never change.

  • Never send anything from the server you don't want the user to see. If the user is not authorised to see it, don't send it. Don't "hide" important bits and pieces in jQuery.data() or data-attributes. Don't squirrel things away in obfuscated JavaScript. Don't use techniques to hide data on the page until the user logs in, etc, etc.

    Everything - everything - is visible if it leaves the server.

  • If you have content you want to protect from "content farm" scraping use email verified user registration (including some form of GOOD reCaptcha to confound - most of - the bots).

  • Protect your server!!! As best you can, make sure you don't leave any common exploits. Read this -> http://owasp.org/index.php/Category:How_To <- Yes. All of it ;)

  • Prevent direct access to your files. The more traditional approach is defined('_SOMECONSTANT') or die('No peeking, hacker!'); at the top of your PHP document. If the file is not accessed through the proper channels, nothing important will be sent from the server.

    You can also meddle with your .htaccess or go large and in charge.

Are you perhaps worried about cross site scripting (XSS)?

If you are worried about data being intercepted when the user enters login information, you can implement double verification (like Facebook) or use SSL

It really all boils down to what your site will do. If it is a run of the mill site, cover the basics in the bullet points and hope for the best ;) If it is something sensitive like a banking site... well... don't do a banking site just yet :P


Just as an aside: I never touch credit card numbers and such. Any website I develop will politely API on to a company with insurance and fleets of staff dedicated to security (not just little old me and my shattered nerves).

0

No there is no way to make this sure. You can implement some Javascript functions which try to prevent this, but if the client just deactivate JS (or a server just ignores it), you can't prevent this.

0

It is really hard to prevent this. I have found a similar discussion here. This will answer most of your queries but if you want even more perfect protection then sophisticated programs and services like Scrapesentry and Distil would be needed.

0
-1

Using JavaScript or php, you just decrease the data scraping, but you can't stop the data scraping. Browser can read the html data so user can view your page source and get that. You can disable key events but can't stop the scraping.

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.