Comments on: Disable Direct Access to a Script With PHP

By: Jim

Jim — Fri, 11 Feb 2011 08:48:17 +0000

That saved my day! Thanks for sharing this :)

By: khen

khen — Thu, 16 Dec 2010 18:45:39 +0000

heheheh.....

i wonder, how we should send "xmlhttprequest" to the restricted page?

By: Chris

Chris — Wed, 27 Oct 2010 17:42:34 +0000

You might want to change it to or instead of and in your if statement.

If HTTP_X_REQUESTED_WITH can be spoofed, then all someone needs to do is spoof if and it will bypass the defined check.

By: kayne

kayne — Tue, 07 Sep 2010 05:49:56 +0000

Great code! but both pieces of code need the closing ) if (!defined('BASEPATH') exit('Nothing to see here.'); needs to be if (!defined('BASEPATH')) exit('Nothing to see here.'); and so on.

By: Maïs

Maïs — Wed, 02 Jun 2010 10:43:32 +0000

Thanks I was looking for that. But in my application I have some page that are get by iframe, so i've add one more line and it's appear to work as i want: if (!defined('BASEPATH') && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) != 'xmlhttprequest') { if ($_SERVER['HTTP_REFERER'] != "http://---adress of my homepage---") { exit('Nothing to see here.'); } }

By: Amatoc Industries

Amatoc Industries — Mon, 08 Mar 2010 08:00:18 +0000

I have to wonder if there is any way to spoof the $_SERVER['HTTP_X_REQUESTED_WITH']...

By: Don Gilbert

Don Gilbert — Sat, 30 Jan 2010 18:45:24 +0000

This answers my question perfectly. I appreciate your hard work in getting and posting this information.

Have a great day!