About is_ajax_request

Yes, it can be bypassed (easily spoofed). You don't want to use it for security. That said, you wouldn't normally show a link to that URI, so it's not likely anyone will go there. You should do some validation before making the MySQL query, because you should be rejecting NULL before allowing a query.

Expert Website Development - Temecula, CA
Community Auth For CodeIgniter 3