Hide the Target URL of a Link in Status Bar
There are some instances where you have redirect the user through one page to get them to another page. There is a way to do this stealthily - without letting the user know that there was a redirect. Yes - it sounds evil - but it don't have to be. Say you have a click tracking software - you have to track each click the users make. To do that you need a redirecting page what will track the clicks. Hopefully, the following illustration will make things clearer...
You don't want the user to see that you are passing through the middle page. Usually, the URL will flash in the address bar for just a second(or less) - so we don't have to worry about that. We just have to prevent the URL from appearing in the status bar when the user hovers over the link.
There are three methods to do this...
- Change the status text.
- Hijack and stop the click event and redirect page.
- Make an Ajax call on click event.
Changing Status Text
This is the old method. This uses the window.status property to show a different URL to the user. Simple and easy method - but it rarely works now a days. This method has been abused by malicious sites a lot - so most browsers have disable this option. In Firefox, you can find that option at Tools -> Preferences -> Content -> Enable Javascript(click on the 'Advanced' Button) -> Change status bar text. If that's checked, you can use window.status to change the status bar text. But its disabled by default.
But if you still want to use this method(not recommended), this is how to do it...
<a href="click_counter.php?redirect_to=http://www.google.com/"
onmouseover="window.status='http://www.google.com/';return true;"
onmouseout="window.status='';">Go To Google</a>
Hijacking Click Event
In this method, when the user clicks on the link, the script captures the click event and stops it. This will prevent the browser from opening up the target page. Then we use location.href to go to the new page. Sample code below...
HTML Code
<a href="http://www.google.com/" id="google-link">Go To Google</a>
Javascript Code
<script type="text/javascript">
function init() {
document.getElementById("google-link").onclick=function(e) {
e=e||window.event;
stopEvent(e);
location.href="click_counter.php?redirect_to=http://www.google.com/";
return false;
}
}
window.onload=init;
</script>
Ajax Method
This is for all you web 2.0 fans. Ajax method simply makes a call to the counter server side script on the click event. This is perhaps the best method of all - as the counter URL doesn't appear at all. Needless to say, the server side script used here will be different from the one used in the other methods - there is no redirection here. The code is very simple as well...
HTML Code
<a href="http://www.google.com/" id="google-link">Go To Google</a>
Javascript Code
<script type="text/javascript">
function init() {
document.getElementById("google-link").onclick=function(e) {
jx("counter.php?url="+escape("http://www.google.com/")); //Use your favorite ajax library here.
}
}
window.onload=init;
</script>

Comments
html-lesson.blogspot.com/2008/06/redirect-to-web-addres.html
Regards,
~ Nathan
function hidestatus(){
window.status=''
return true
}
Thanks for these useful parts of codes. This is exactly what I was looking for.
Regrads,
Saeed.
Perhaps a use this and that tutorial would help ?
ck.php?oaparams=2__bannerid=32__zoneid=0__cb=96b39226f8__maxdest=http://someurl.com/
What's wrong with your redirector eample?
It breaks the three simple rules of a good redirector:
1. Do not put target URLs in the redirector URL parameters.
2. Do not put easily decoded target URLs in the redirector URL parameters.
3. In fact, do not put target URLs in the redirector URL parameters IN ANY FORM AT ALL.
Always use some kind of server-side lookup for the target URL based on an index in the redirector URL parameters and never allow arbitrary, client-side provided URLs to reflect through the redirector.
If you don't start by thinking about the security implications of what you are coding you will just pour out mindless, readily abusable crud over and over -- even MS won't employ folk like that now...
If you are implementing a redirector, please, at a minimum, carefully read the material linked from spamlinks.net/prevent-secure-redirect.htm
now that? he's a noob skiddy phisher wannabe.
the latest browsers (both and ie and ff) default to having this disabled...
also, this falls into the quite evil category... just think of all the security issues this brings up...
dont do it son, dont do it!
a, strong, em, b, i, code, pre, pandbrallowed. Other tags will be shown as code(< will become <). Urls, Line breaks will be auto-formated.