2
\$\begingroup\$

I've got a text I don't want to be copied by users.
To avoid that, I'm using this code:
index.php

<?php
session_start();
$characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
    $randomString = '';
    for ($i = 0; $i < 100; $i++) {
        $randomString .= $characters[rand(0, strlen($characters) - 1)];
    }
$_SESSION['token'] = $randomString;
?>
<!DOCTYPE html>
<head>
  <meta charset="utf-8">
  <title>Test</title>
  <script src="../jquery.js"></script>
</head>
<body>
<script>
$(document).ready(function(){
$("#content").load("page.php?token=<?php echo $_SESSION['token']; ?>", function (responseText, textStatus, req) {if (textStatus == "error") {
$("#content").html('An error occurred :(');
}
});
});
</script>
<div id="content">Please wait...</div>
</body>

page.php

<?php
session_start();
if(!empty($_SESSION['token']) AND $_GET['token']==$_SESSION['token']){echo '
<script>
function error(){
alert("This text is protected");
}
$(document).ready(function(){ 
$(document).mousedown(function(e){ 
    if( e.button == 2 ) { 
    error();
    return false;
    } 
  }); 
  $(document).keydown(function(){
  error();
  return false;
  });
});
</script>
Text...';
unset($_SESSION['token']);
}
else{echo 'Error.';
}
?>

Is this method reliable?

\$\endgroup\$
  • \$\begingroup\$ why can't they just screenshot it and re-write it? \$\endgroup\$ – raptortech97 Nov 21 '14 at 19:30
  • 4
    \$\begingroup\$ There's no reliable method to do this. They can just deactivate javascript. Even if you made images out of your text, there's plenty of tools that will extract text from images. \$\endgroup\$ – Michael Nov 21 '14 at 19:53
  • 2
    \$\begingroup\$ watching the XHR requests you'll be able to copy the response as plain text, or are you concerned about normal copy/paste from the browser? \$\endgroup\$ – CᴴᵁᴮᴮʸNᴵᴺᴶᴬ Nov 21 '14 at 20:04
  • \$\begingroup\$ @Michael I didn't think about OCR, thanks for pointing out that! \$\endgroup\$ – Stubborn Nov 21 '14 at 20:10
  • \$\begingroup\$ @DannyHearnah No, I was trying to block every method (or at least the quickest ones) to copy the text, as the one you mentioned: I hadn't think about that, thanks for pointing it out! \$\endgroup\$ – Stubborn Nov 21 '14 at 20:12
3
\$\begingroup\$

That is an old skool question, the common wisdom is that you cannot prevent a user from getting to the text. There are a number of ways to get around your protection.

For example, in Chrome, open Developers Tools, open your site, check the web request, and then all the text will be perfectly copy pastable.

Other than that:

  • alert() has been a bad practice for 20 years now, please use something else
  • Indent your code, use jsbeautifier if you have trouble
  • In the keydown, I would check whether the control key is pressed before throwing an error, unless the user never needs to press PageUp or PageDown
  • I am not entire surely, but I think you will need event.preventDefault(); to really prevent right clicking etc.
\$\endgroup\$
1
\$\begingroup\$

To answer the question which was asked, no.

The best method of document protection will be found in a technology designed with document protection in mind. HTML is not that technology. As others have pointed out, there are plenty of methods for copying the text both by disabling or modifying browser features such as javascript, as well as just requesting the document directly.

There are, however, technologies available to protect documents. While nothing is foolproof, using something like an encrypted PDF document with the appropriate permissions set will likely be the "next best thing" that can be done in a digital form.

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.