Question

How would you go about using tokens with the following?

$('#DIV').load('child.php?id='+id);

So that you couldn’t access child.php straight from the browser and type child.php?id=1

If this is not possible with tokens would there be any other way?

Thought about XMLHttpRequest as follows:

var mygetrequest=new ajaxRequest();
mygetrequest.onreadystatechange = function(){
    if (mygetrequest.readyState==4){ 
        if (mygetrequest.status==200 || window.location.href.indexOf("http")==-1){ 
            document.getElementById("DIV").innerHTML = mygetrequest.responseText;
        } else{ 
            alert("An error has occured making the request");
        }
    }
}
mygetrequest.open("GET", "child.php?id="+id, true);
mygetrequest.send(null);

Many thanks.

Answer 1

What you need is to check if the request is an ajax request (from load()) or not, this can be done by the following:
child.php:

if(isset($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest') {
    // it's an ajax request validate id and continue!
} else {
    // this is not an ajax request, get out of here!
}