Question

How to verify if user have posted with XMLHttpRequest some data to PHP?

This is the best way? If not, how I can do this?

I have the follow code

if(isset($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) === 'xmlhttprequest') {
    // PROBABLY AJAX REQUEST
}

My question is, how I can verify php://input exists and are not empty? I think the follow code do the work, but need to know if this is a correct way:

if(file_get_contents("php://input") == '') {
    // HAVE NOT POSTED
} else {
    // POSTED
}

Answer 1

Set a custom header as part of your AJAX function, and check for the presence of that header in your server-side code.

Perhaps the best way to do this is to generate a key on the server-side, pass that to the client-side code that contains the AJAX call, then make AJAX send it back to the server and verify that it is a valid key. This is the most effective way to prevent someone faking an AJAX request.

---

To check that php://input exists and is not empty, use this:

$phpinput = file_get_contents("php://input");
// From the docs: "Note: A stream opened with php://input can only be read once"
if( !$phpinput) {
    // phpinput is empty
}