how to protect access to a php file?

Question

Galea I am using the Jquery auto complete plugin. It works perfectly. I use jquery to call a php file that queries in the Databank.

I call him that:

 $("#auto").autocomplete("Busca/Cadastros.php", {
        width: 500,
        multiple: false,
        matchContains: true,
        formatItem: formatItem,
        formatResult: formatResult
  }); 

The problem is that if I type the file path ('path/Search/Register.php') in the browser it opens the query in the BD. How do I block this file? ie it is not possible to open it by browser and only my jquery open it.

Someone knows how to do it?

Answer 1

If this request is POST in PHP you can do it first of all:

if($_SERVER['REQUEST_METHOD'] == 'POST'){

   // Todo seu código

}

This way by GET it will not be able to access the URL through the browser’s address bar. But I’m seeing other ways too, since someone can make a CURL POST in that URL.

To verify that the request is AJAX:

if(!empty($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest') {

   // É Ajax, faça seu código aqui.

}

It would be good your autocomplete make the POST request.

It’s hard to think through all the checks, there will always be a way to circumvent the lawsuits. Avoid what you know and don’t worry so much about other things.

Backup exists for this. Restore also, which is more important than the backup in itself.

Your code via POST and to send more parameters in the POST:

In the parameter data you define more variables. Remembering that the term is the past for PHP to search.

$("#birds").autocomplete({
    source: function (request, response) {
        $.ajax({
            type: "POST",
            url:"Busca/Cadastros.php",
            data: { 
                 term: request.term,
                 outra_variavel: valor_outra_variavel
            },
            success: response,
        },
    },
    width: 500,
    multiple: false,
    matchContains: true,
    formatItem: formatItem,
    formatResult: formatResult
});

Answer 2

Ideally, you do not put the server files (i.e., PHP) into the same folder or into "daughter" folders in the application. In that case, the way would be as follows:

$("#auto").autocomplete("../Busca/Cadastros.php", {
        width: 500,
        multiple: false,
        matchContains: true,
        formatItem: formatItem,
        formatResult: formatResult
  });

But of course, you need to limit access to anything outside that scope. That way, it doesn’t matter if the access is done by GET or POST, if the user tries a direct access, he won’t be able.