仅允许PHP文件与之前网页的“授权”一起运行[重复]

Question

Possible Duplicate:
AJAX only access

So I have these javascript functions I run depending on who won a contest.

function winA() 
{
var x = "<?php echo $id;?>"
$.ajax({ url: 'win.php' ,
         data: { id: x }
   }); 
}

function winB() 
{
var val = "<?php echo $i;?>"
$.ajax({ url: 'win.php' ,
         data: { id: val }
   }); 
}

The file win.php updates a MySQL with who won. What troubles me is if someone simply goes to

http://mysite.com/win.php?id=1

and refreshes it a whole lot of times I clearly will have some incorrect results on the MySQL server.

I am wondering exactly how one would make it so that URL could only be accessed when appropriate, via this ajax call. Alternatively make it so the win.php file only to actually execute when it has 'authorization' that expires after loading the php file.

Thanks in advance, Aaron.

Answer 1

You could use a session, expanding from my comment:

Main game page

<?php
session_start();

//Do game....

//Decide Winner

$_SESSION['winner']='A'; //or B depending on who won

?>

Then an AJAX request with blank params ect, just so won.php gets touched

function win(){
  $.ajax({
    url: "win.php",
    cache: false
  }).done(function(html){
   //Dont do anything or you could get a response from the won.php request an update something
  });
 }

Win.php

<?php
session_start();

if(isset($_SESSION['winner'])){
    $winner=$_SESSION['winner'];
    //Do update ect

    //Unset Winner session var, by unsetting the user would need to play the game again to get it set
    unset($_SESSION['winner']);
}else{
    header('Location: ./index.php');
}

?>