# Protecting webpage text from being selected

I've got a text I don't want to be copied by users.
To avoid that, I'm using this code:
index.php

<?php
session_start();
$characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';$randomString = '';
for ($i = 0;$i < 100; $i++) {$randomString .= $characters[rand(0, strlen($characters) - 1)];
}
$_SESSION['token'] =$randomString;
?>
<!DOCTYPE html>
<meta charset="utf-8">
<title>Test</title>
<script src="../jquery.js"></script>
<body>
<script>
$(document).ready(function(){$("#content").load("page.php?token=<?php echo $_SESSION['token']; ?>", function (responseText, textStatus, req) {if (textStatus == "error") {$("#content").html('An error occurred :(');
}
});
});
</script>
</body>


page.php

<?php
session_start();
if(!empty($_SESSION['token']) AND$_GET['token']==$_SESSION['token']){echo ' <script> function error(){ alert("This text is protected"); }$(document).ready(function(){
$(document).mousedown(function(e){ if( e.button == 2 ) { error(); return false; } });$(document).keydown(function(){
error();
return false;
});
});
</script>
Text...';
unset(\$_SESSION['token']);
}
else{echo 'Error.';
}
?>


Is this method reliable?

• why can't they just screenshot it and re-write it? – raptortech97 Nov 21 '14 at 19:30
• There's no reliable method to do this. They can just deactivate javascript. Even if you made images out of your text, there's plenty of tools that will extract text from images. – Michael Nov 21 '14 at 19:53
• watching the XHR requests you'll be able to copy the response as plain text, or are you concerned about normal copy/paste from the browser? – CᴴᵁᴮᴮʸNᴵᴺᴶᴬ Nov 21 '14 at 20:04
• @Michael I didn't think about OCR, thanks for pointing out that! – Stubborn Nov 21 '14 at 20:10
• @DannyHearnah No, I was trying to block every method (or at least the quickest ones) to copy the text, as the one you mentioned: I hadn't think about that, thanks for pointing it out! – Stubborn Nov 21 '14 at 20:12

That is an old skool question, the common wisdom is that you cannot prevent a user from getting to the text. There are a number of ways to get around your protection.

For example, in Chrome, open Developers Tools, open your site, check the web request, and then all the text will be perfectly copy pastable.

Other than that:

• alert() has been a bad practice for 20 years now, please use something else
• Indent your code, use jsbeautifier if you have trouble
• In the keydown, I would check whether the control key is pressed before throwing an error, unless the user never needs to press PageUp or PageDown
• I am not entire surely, but I think you will need event.preventDefault(); to really prevent right clicking etc.