Question

I am working on some auto-suggest feature.

The script is fairly itself.
When a character is typed in to the textbox it sends a ajax post (or get) request to the php file which queries the database and returns a result set.

But the problem is that the php file is accessible on its own. So it can be called directly. Is there a way to prevent this and make that php file to serve only the ajax request on my application.

Thanks in advance.

Answer 1

No, there isn’t. If your script can be requested, it can be requested by anything. It is possible to differentiate ajax requests from normal ones by testing for the x-requested-with header and responding accordingly, that is, if it does not contain the value XMLHTTPRequest you simply exit() the script. However, headers can always be spoofed. So no, you can’t.