Identify ajax calls

[eluser]mddd[/eluser]
I understand. I'm just saying: if you prevent someone from loading the script through the address bar, they can always load it through an Ajax call that they make themselves. So there is not really any way you can block a user from accessing that information. Simply because an Ajax call is exactly that: a call from the user's computer. You should look for a different situation; for instance slowing down the script if it is called multiple times from the same location. If you have the script respond slower and slower if it is called quickly in succession, it won't be so interesting for someone to misuse it.