Q: How to secure window.location URL i just create two Pages. Page One have a couple of Buttons. If a user click on one Button, the ID of the button is send to another Page and is shown in a Div.
Example:
Page 1:
<script type="text/javascript">
   $(document).ready(function(){
   $(".btn").click(function()
{

    var val = $(this).attr("id");

    $(".divX").text(ausles);

     window.location = 'page2.php?valX=' + val;

});});  
</script>

Page2.php
<div class="ed">  <?php 
echo $_GET["valX"];
?></div>

My Problem:
A user can now change the Value (x77) in the URL :localhost/pt1/page2.php?valX=x77`
How can i block this?

A: You need to decide if it is that much of a deal that a user can change the value of valX.
Having said that, there are a couple of ways you could resolve this issue.
$_POST
You could post the value of valX as a form submission instead of a redirect, the downside to this is if the user refreshes or reloads the page they could lose the post data.
$_COOKIE
You could set cookies, this can be done in JS and retrieved in PHP, for examples of how to set a cookie in Javascript Look Here, cookies can still be manipulated but are less likely to.
$_SESSION
This is probably the most secure way, but requires you to set a session in PHP, this requires you to use AJAX in your situation, when the button is clicked, AJAX to a php file that stores the value in a session, then retrieve it on the second page.

A: You cannot block changes to the URL. You have two choices - 
a. Change to using POST instead of GET where nothing is in the URL
b. Require more than one item in the query string where all items must be valid to view the page.

A: try to post your values on another page . Below code will create a form on run time and will auto submit to given url
$(".btn").click(function(){
  var val = $(this).attr("id");
  $(".divX").text(ausles);
  var form = document.createElement('form');
  form.method = 'post';
  form.action = 'page2.php';
  form.innerHTML = '<input type="hidden" id="valX" name="valX" value="' + val + '">';
  document.body.appendChild(form);
  form.submit();
});

then get on page2.php
<div class="ed">  <?php echo $_POST["valX"];?></div>


A: Define an array with the buttons like this
$buttonValues = array(array(1, 'Text for number 1'), ...);

Now you can easily loop through that for outputting.
And in page2.php you can check whether the submitted ID is in the array and if not abort.
This is a whitelist approach and thus immune to any client side trickery.
Sending it by POST or in a COOKIE just means that it cannot be circumvented by hand. If someone takes the time to emulate all requests POST and COOKIES can be changed.
