允许ajax调用时禁止直接访问[重复]

Question

This question already has an answer here:

• Prevent direct api access from browser 1 answer
• How to allow access to API only for own pages? 1 answer
• How to prevent direct access to my JSON service? 6 answers

I use this code to disallow direct access to php file

if (__FILE__ == $_SERVER['DOCUMENT_ROOT'].$_SERVER['PHP_SELF']){
  die("Direct access forbidden");
}

My problem is I need to call the php this way

xmlhttp.open("GET","getverse.php",true);

it also return Direct access forbidden error.

How can I allow this call to php file while disallowing direct access to it from a browser?

Thanks

</div>

Answer 1

Am not sure its just a single PHP file or you are using any Framework or a CMS.

But you can try,

if (__FILE__ == $_SERVER['DOCUMENT_ROOT'].$_SERVER['PHP_SELF'] && !isset($_GET['ajax'])){
  die("Direct access forbidden");
}  

Invoke this file using

xmlhttp.open("GET","getverse.php?ajax=1",true);