PHP: Respond to ajax request only

Question

Is it possible force PHP only respond to ajax requests?? By setting headers or etc. for example we have this code:

if (str.length == 0) { 
    document.getElementById("txtHint").innerHTML = "";
    return;
} else {
    var xmlhttp = new XMLHttpRequest();
    xmlhttp.onreadystatechange = function() {
        if (xmlhttp.readyState == 4 && xmlhttp.status == 200) {
            document.getElementById("txtHint").innerHTML = xmlhttp.responseText;
        }
    };
    xmlhttp.open("GET", "gethint.php?q=" + str, true);
    xmlhttp.send();
}

and we want to make an ajax request. Now when we type 'SITENAME.COM/gethint.php?q=' in browser it shows something. How to prevent this event? thanks.

Answer 1

You can't guarantee that somebody won't be able to access this on a non Ajax call, but the following could help prevent non-ajax requests:

if(!empty($_SERVER['HTTP_X_REQUESTED_WITH']) 
     && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest') {
    // more code here
}

HTTP headers are fairly easy to set, so it wouldn't be something to secure it... Only disallow the average user from hitting the page directly.

Answer 2

You can try this.

if (strtolower(filter_input(INPUT_SERVER, 'HTTP_X_REQUESTED_WITH')) === 'xmlhttprequest') {
   // I'm AJAX!
}