PHP 代码对您的问题毫无用处.

PHP code is useless for your question.

为了混淆动作 url，您可以使用一些 javascript 来设置仅在提交时的属性.在这里你可以看到一个愚蠢的例子:http://codepen.io/anon/pen/gprygB

To obfuscate action url you could use some javascript to set attribute only on submit. Here you can see a dumb example: http://codepen.io/anon/pen/gprygB

$("form").submit(function() {
  $(this).attr("action", "realAction");
});

因此，您还可以使用一些 crypt/uglify 库来隐藏 js 文件中的 realAction.

Thanks to this you could also use some crypt/uglify library to hide the realAction inside js file.