You can hide whatever you want from the html, but if you need to pass a value between php and JS, retrieved either via jQuery, get, post or any other method, the end user will be able to read it.
NOTE:
You guys can down-vote as much as you want, but I'll keep my answer until someone explain how to "Pass variable from PHP to Javascript", without exposing the data to the end user.
EDIT +4 Years later (2020):
A possible solution is to encrypt the code your want to hide from the end user and decrypt it when the user posts it back, i.e.:
<?php
function encdec($t, $s){
$secret_key = 'secret_key';
$secret_iv = 'secret_iv';
$output = false;
$encrypt_method = "AES-256-CBC";
$key = hash( 'sha256', $secret_key );
$iv = substr( hash( 'sha256', $secret_iv ), 0, 16 );
if( $t == 'e' ) {
$output = base64_encode( openssl_encrypt( $s, $encrypt_method, $key, 0, $iv ) );
}
else if( $t == 'd' ){
$output = openssl_decrypt( base64_decode( $s ), $encrypt_method, $key, 0, $iv );
}
return $output;
}
$my_secret = encdec("e", "internal_XPto123");
echo $my_secret;
# Then, when the user posts it back, via form or any other method, you decrypt it:
$my_secret = encdec("d", $_REQUEST['some_arg']);
if (preg_match('/^internal_[a-z\d]{7}$/i', $my_secret)) {
# string structure matches, continue...
}
The above can be useful to, let's say, hide a subscription id from the end user which, if exposed, could reveal information about your internal structure, but that you need to use as a form of identification on your code.
I've used this to populate a custom attribute of button that was later used as argument of a jquery ajax request when the button was clicked.
A rule of thumb is to never trust the user input, but this way, it will be very difficult to try any kind of injection without knowing the real values, and if you add recaptcha3 to the mix, it's a no go for anyone trying to mess with your system.
Simple DEMO
