How to make sure that a person does not see the results from the URL of the PHP script?

How to make sure that a person does not see the results from the PHP script url?

Recently, while viewing the source of the site that made the AJAX call, I tried to execute the link in the browser

www.site.com/script.php?query=value

Instead of getting the result that I expected to see, I saw a message stating that only scripts should view this page.

How do you limit the script to the fact that the script has access to it?

UPDATE:

here is the DEMO page page

+3
source share
8 answers

with php you can only check and show results if the page is called via ajax

function isAjax() {
    return (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && ($_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest'));
}

if(isAjax()) {
    // display content
} else {
    // not ajax, dont show
    echo 'Invalid Request';
}
+9
source

Short answer: you cannot.

: , HTTP- ( Accept to application/json ). , . , , , . , , .

+10

. . post, , .

+6

HTTP- . - "" . , .

100%, .

+4

, script , rpc.php(, net firebug):

X-Requested-With    : XMLHttpRequest

, setRequestHeader method, , activex, xmlhttprequest, .

+1

script AJAX, , AJAX , , script.

PHP , "" Apache PHP-, .

0

php- "view" script ajax.

  • 'index.php' .
  • PHP , , .
  • ajax .
  • ajax , .

, ajax.

, ajax . , .

http://us.php.net/manual/en/book.session.php

0

php:

if (!defined('SOMETHING')) {
    die('only scripts have direct access');
}

index.php SOMETHING:

define("SOMETHING", "access granted.");

edit: , btw

edit2: , , ajax. , .

-2

Source: https://habr.com/ru/post/1714707/


All Articles