php script prevent direct access

Question

I am using ajax to get value from php scripts (for example cost.php) and i know it would be easy to access it directly and get that value. I am even running cron job on same script(cost.php) so cron job would not work if i use following...

if(!empty($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest') {
  //code here
  die('Invalid Request!');
}

Is this the safe way to prevent, and cron jobs would not work if i use the above code, so what can i use to secure value from end user. thanks.

Why would you hide the value from the end user? Use a password defined from your cronjob wich is defined in the php script too. And use no security other than sql attack protection for the ajax calls for the value. — Jonas m
– Jonas m, Commented Jan 25, 2012 at 9:48
If the script is returning a value to an Ajax request, the data is already 'out there' for the user to see. — Ayush
– Ayush, Commented Jan 25, 2012 at 9:48
we are generating value from this script, which we don't want to get scrapped. — seoppc
– seoppc, Commented Jan 25, 2012 at 9:50

ajreal · Accepted Answer · 2012-01-25 09:56:31Z

4

In order to separate execution of cronjob, you can consider to use php_sapi_name

A simple usage (more reliable that depend on server side variables) :-

if (php_sapi_name() == "cli") // via cronjob or via cli
{
  die("invalid request");
}

PS: constant PHP_SAPI carry the same value, so you can rewrite to :-

if (PHP_SAPI == "cli")
{
  die("invalid request");
}

edited Jan 25, 2012 at 9:56

answered Jan 25, 2012 at 9:49

ajreal

47.4k11 gold badges98 silver badges119 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

djot · Accepted Answer · 2012-01-25 09:48:30Z

0

if (!eregi('cost.php',basename($_SERVER["REQUEST_URI"]))) { die('access denied'); }

answered Jan 25, 2012 at 9:48

djot

2,9474 gold badges22 silver badges28 bronze badges

1 Comment

djot Over a year ago

@richsage: Yeah right, thanks for mentioning ... just copied the line from an old project. So, use preg_match instead.

PiTheNumber · Accepted Answer · 2012-01-25 09:54:00Z

0

Use a secret password for the cronjob

if (isset($_REQUEST['cronpw']) && $_REQUEST['cronpw'] == 'supersecret')
{
    // this is the cronjob
}
else
{
    // this not
}

answered Jan 25, 2012 at 9:54

PiTheNumber

23.7k17 gold badges115 silver badges191 bronze badges

Comments

Girish · Accepted Answer · 2012-10-07 17:16:08Z

0

Add this at the top of code to stop direct script access.

if (!defined('BASEPATH')) exit('No direct script access allowed');

If you want to allow AJAX requests then,

if (!defined('BASEPATH') &&
strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) != 'xmlhttprequest')
exit('You are not allowed here...');

answered Oct 7, 2012 at 17:16

Girish

9038 silver badges16 bronze badges

Collectives™ on Stack Overflow

php script prevent direct access

4 Answers 4

Comments

1 Comment

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related