This is my method to handle XMLHTTPRequests.
Avoids mysql request, foreign access, nerves user, double requests.
jquery
var allow=true;
var is_loaded="";
$(document).ready(function(){
....
$(".xx").on("click",functio(){
if(allow){
allow=false;
if(is_loaded!="that"){
$.post("job.php", {job:"that",word:"aaa",number:"123"},function(data){
$(".aaa").html(data);
is_loaded="that";
});
}
setTimeout(function(){allow=true},500);
}
....
});
job.php
<?PHP
ob_start('ob_gzhandler');
if(!isset($_SERVER['HTTP_X_REQUESTED_WITH']) or strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) != 'xmlhttprequest')exit("bad boy!");
if($_POST['job']=="that"){
include "includes/that.inc;
}
elseif($_POST['job']==
....
ob_end_flush();
?>
that.inc
if(!preg_match("/\w/",$_POST['word'])exit("bad boy!");
if(!is_numeric($_POST['number'])exit("bad boy!");
//exclude more.
$path="temp/that_".$row['word']."txt";
if(file_exists($path) and filemtime("includes/that.inc")<$filemtime($path)){
readfile($path);
}
else{
include "includes/openSql.inc";
$call=sql_query("SELECT * FROM that WHERE name='".mysql_real_escape_string($_POST['word'])."'");
if(!$call)exit("ups");
$out="";
while($row=mysql_fetch_assoc($call)){
$out.=$_POST['word']." loves the color ".$row['color'].".<br/>";
}
echo $out;
$fn=fopen($path,"wb");
fputs($fn,$out);
fclose($fn);
}
if something change at the database, you just have to delete involved files.
Hope it was English.
