How to tell if a page is being called via Ajax, or on it's own

Question

I have a page that loads other pages via Ajax (think frames, except without the frames).

Obviously these pages can all be called independently, so I want to detect if they are being called via the Ajax, and if not, redirect to the main Ajax page.

The pages are php pages, so I have access to that as well.

index:

    goto = "StandalonePrograms.php";
    var clear = "<br style='clear:both;'>"
    if(goto != ''){
        $.ajax({
            url: goto,
            context: document.body,
            success: function(data){
                $('#mainwindow').html(data + clear);
                $('#mainwindow').find("script").each(function(i){
                    eval($(this).text());
                });
            }
        });
    }

http://stackoverflow.com/questions/3696650/how-to-detect-if-file-is-being-accessed-or-requested see the selected answer — Kevin B, Mar 22 '12 at 18:38
Have the AJAX request call the page with a special query string. It's not foolproof, but it might be good enough. — Blazemonger, Mar 22 '12 at 18:39
possible duplicate of [How do I check if the request is made via AJAX with PHP?](http://stackoverflow.com/questions/4301150/how-do-i-check-if-the-request-is-made-via-ajax-with-php) — Marc B, Mar 22 '12 at 18:39

score 16 · Accepted Answer · answered Mar 22 '12 at 18:38

16

Modern browsers add the following request header when a request is made using the XMLHttpRequest object:

X-Requested-With: XMLHttpRequest

In PHP, check the existence of this header using:

$_SERVER['HTTP_X_REQUESTED_WITH']

answered Mar 22 '12 at 18:38

Rob W

341,306
83
791
678

3

For PHP specifically, you can check `$_SERVER['HTTP_X_REQUESTED_WITH']`. – Michael Mior Mar 22 '12 at 18:39
1

This is not working with PHP 7.1.11 and whatever the latest Chrome browser is, as of Jan 18 – Mawg says reinstate Monica Jan 06 '18 at 13:19

score -1 · Answer 2 · answered Apr 30 '14 at 10:53

You cannot never trust clients and their sent information! The headers can be spoofed by hackers (for example with cURL) and even HTTP_X_REQUESTED_WITH is not reliable. there is no 100% trusted way to know that. The Only way is using captcha...

How to tell if a page is being called via Ajax, or on it's own

2 Answers2

Linked