Q:

Stopping unnecessary posts to PHP file

Above you can see Google's account registration page telling me that a username is already taken. Firstly, this is how I assume it is informing me:

Upon the text input losing focus an AJAX call is made to a file somewhere within Google's web server
The server (running Python I believe?) processes the username and performs a check against a database via a query.
Once the database has performed the query the result is returned to the server.
Then it is returned to the browser where it is made pretty and informs me of the result in a way that is useful to the user.

My question is to do with where the processing occurs. Wherever the processing is happening it is purely serving a purpose for this page. I as any person shouldn't be able to find this file where Google perform this check and post data to it and see a response. I want to find out what is stopping me, how are Google preventing me from making a check manually against this Python file that is making the check? Or are they at all?
Currently I am using PHP to do the exact same thing as Google are doing here. The PHP file that is being invoked via AJAX is in the same directory as the registration, it is called "check.php". If you were to post a username to that file on my web server you would see the response and this is what I need to stop (or should I just not be stopping it?). How can this be done?
Thanks

A:

If I understand you correctly, you are trying to determine whether or not a request is via ajax, and if not, block the request...
You have several options for this (will have missed some out):

Attach a 'session_id' to the form and validate it on the 'check.php' page. If it is valid then proceed.
Look for the AJAX request header (example below). This is not necessarily reliable as headers can be manipulated
Manipulate the header yourself using jQuery ajax and then test for it on 'check.php'

Example of option 2:
if(isset($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) === 'xmlhttprequest'){
    // I'm AJAX!
}

You have other options as well, but this should be a good start...

