How do I prevent direct controller function access?

[eluser]Aken[/eluser]
You shouldn't combine those IF checks together, though, because they aren't related.

I never use a controller method strictly for accepting form submissions -- I always use the same method that you'd view through the URL, and I use normal Form validation library stuff to process it. I then use the ajax check to determine what type of data needs to be output - either a normal view load if through the browser, or a JSON or similar response if through ajax.