将字符串安全地传递给JS

<?php

$secret =  "data";
$givesecret = $_GET['givesecret'];

if ($givesecret>0) {
    echo $secret;
}
?>

var rndvar = 0;
//something is done in a loop
rndvar++;
//now something is completed and i want to reveal the secret
var xhr = new XMLHttpRequest();
            xhr.open("GET", "containssecret.php?givesecret="+rndvar);
            xhr.onreadystatechange = function()
            {
                if(xhr.readyState == 4 && xhr.status == 200) {
                    alert(xhr.responseText);
                }
            }
xhr.send();