blocks|key|1070830|text|$_SERVER中的变量实际上并不是PHP的一部分，这就是为什么您在PHP文档中找不到它们的原因。它们是由Web服务器准备的，Web服务器将它们传递给脚本语言。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1070831|据我所知，X-Requested-With是由大多数主要框架的Ajax函数发送的，但不是全部(例如，Dojo在两年前才添加了它：#5801)。因此，考虑到@bobince的评论，可以肯定地说，它通常不是一个100%25可靠的方法来确定一个请求是否是一个AJAX请求。|1070832|唯一100%25安全的方法是与请求一起发送一个预定义的标志(例如GET变量)，并让接收页面检查该标志的存在。|1070833|entityMap|0|LINK|mutability|MUTABLE|url|http://trac.dojotoolkit.org/ticket/5801^0|0|8|0|5|G|1S|5|0|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@$9|S|A|T|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|U|8|@$9|V|A|W|B|C]]|D|@$9|X|A|Y|1|Z]]|E|$]]|$1|H|3|I|5|6|7|10|8|@]|D|@]|E|$]]|$1|J|3|-4|5|6|7|11|8|@]|D|@]|E|$]]]|K|$L|$5|M|N|O|E|$P|Q]]]]

The variables in <code>$_SERVER</code> are not really part of PHP, which is why you won't find them in the PHP documentation. They are prepared by the Web server which passes them on to the scripting language.

As far as I know, the <code>X-Requested-With</code> is sent by the Ajax functions of most major Frameworks but not all (Dojo, for example, added it only two years ago: <a href="http://trac.dojotoolkit.org/ticket/5801" rel="noreferrer">#5801</a>). As such, and taking into considerations @bobince' comments, it's safe to say it's not generally a 100% reliable method to determine whether a request is an AJAX request or not. 

The only 100% secure way is to send a pre-defined flag (e.g. a GET variable) along with the request and for the receiving page to check for the presence of that flag.

blocks|key|1070906|text|不要忘记，您可以很容易地使用cURL欺骗任何标头，如下所示|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1070907|curl_setopt($ch,CURLOPT_HTTPHEADER,array("X-Requested-With+:+XMLHttpRequest"));|code-block|syntax|javascript|1070908|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

don't forget that you can easily spoof any header with cURL like so

<pre><code>curl_setopt($ch,CURLOPT_HTTPHEADER,array("X-Requested-With : XMLHttpRequest"));
</code></pre>

blocks|key|1285454|text|以HTTP_开头的HTTP键是从$_SERVER请求头部生成的。在本例中，是指X-Requested-With标头。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1285455|entityMap^0|1|5|G|8|13|G|0^^$0|@$1|2|3|4|5|6|7|H|8|@$9|I|A|J|B|C]|$9|K|A|L|B|C]|$9|M|A|N|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|O|8|@]|D|@]|E|$]]]|G|$]]

<code>$_SERVER</code> keys that start with <code>HTTP_</code> are generated from HTTP request headers. In this case, the <code>X-Requested-With</code> header.

blocks|key|1070868|text|这个头文件是所有AJAX库中正在进行的标准化工作。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1070869|它不会记录在php文档本身中，而是记录在设置这个头文件的不同AJAX库中。通用库确实发送了这个头文件:+jQuery，Mojo，Prototype，...|1070870|通常，这些库将使用以下命令设置标题|1070871|xhrobj.setRequestHeader("X-Requested-With",+"XMLHttpRequest");|code-block|syntax|javascript|1070872|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|N|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|O|8|@]|9|@]|A|$]]|$1|F|3|G|5|H|7|P|8|@]|9|@]|A|$I|J]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

This header is a standardization-in-progress from all of the AJAX libraries out there.

It won't be documented in the php documentation per-se, but rather in the different AJAX libraries that set this header. Common libraries do sent this header: jQuery, Mojo, Prototype, ...

Usually these library will set the header using 

<pre><code>xhrobj.setRequestHeader("X-Requested-With", "XMLHttpRequest");
</code></pre>

blocks|key|1070942|text|你也可以归咎于一些浏览器的错误--看看这个问题及其对Firefox的解决方案|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1070943|Firefox+does+not+preserve+custom+headers+during+Ajax+request+redirect:+an+ASP.NET+MVC+solution|offset|length|1070944|IE也有caching+issue，它比请求方法的检测更严重。|1070945|您无论如何都需要添加缓存终结器来避免缓存，所以为什么不使用另一个标志来指定ajax调用-或者更好的是，您可以使用不同的URL，比如http://ajax.mysite.com/endpoint/sevice?params|1070946|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/questions/1588589/firefox-does-not-preserve-custom-headers-during-ajax-request-redirect-an-asp-net|1|http://greenash.net.au/thoughts/2006/03/an-ie-ajax-gotcha-page-caching/|2|http://ajax.mysite.com/endpoint/sevice?params^0|0|0|2M|0|0|4|D|1|0|1T|19|2|0^^$0|@$1|2|3|4|5|6|7|V|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|W|8|@]|9|@$D|X|E|Y|1|Z]]|A|$]]|$1|F|3|G|5|6|7|10|8|@]|9|@$D|11|E|12|1|13]]|A|$]]|$1|H|3|I|5|6|7|14|8|@]|9|@$D|15|E|16|1|17]]|A|$]]|$1|J|3|-4|5|6|7|18|8|@]|9|@]|A|$]]]|K|$L|$5|M|N|O|A|$P|Q]]|R|$5|M|N|O|A|$P|S]]|T|$5|M|N|O|A|$P|U]]]]

You can also blame some browser bugs - see this question and its solution for Firefox

<a href="https://stackoverflow.com/questions/1588589/firefox-does-not-preserve-custom-headers-during-ajax-request-redirect-an-asp-net">Firefox does not preserve custom headers during Ajax request redirect: an ASP.NET MVC solution</a>

IE also having <a href="http://greenash.net.au/thoughts/2006/03/an-ie-ajax-gotcha-page-caching/" rel="nofollow noreferrer">caching issue</a> which is more serious then detection of request method.

You anyway needs to add cache busters to avoid caching, so why not use another flag to specify the ajax call - or more better you can use different URL like <a href="http://ajax.mysite.com/endpoint/sevice?params" rel="nofollow noreferrer">http://ajax.mysite.com/endpoint/sevice?params</a>

blocks|key|1071018|text|要确保HTTP请求是否真的是通过AJAX发送的，最好的解决方案是使用会话检查，在get参数中发送session_id，然后检查这个会话是否允许！|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1071019|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

The best solution to make sure if an HTTP request is truly sent via AJAX is using SESSION checking , you send session_id in a get parameter and you check this session if it's allowed or not !

blocks|key|1071030|text|$headers+=+apache_request_headers();
$is_ajax+=+(isset($headers['X-Requested-With'])+&&+$headers['X-Requested-With']+==+'XMLHttpRequest');|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|1071031|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$B|C]]|$1|D|3|-4|5|E|7|H|8|@]|9|@]|A|$]]]|F|$]]

<pre><code>$headers = apache_request_headers();
$is_ajax = (isset($headers['X-Requested-With']) &amp;&amp; $headers['X-Requested-With'] == 'XMLHttpRequest');
</code></pre>

All over the Internet, included even here at Stack Overflow, people state that a good way to check if a request is AJAX or not is to do the following:

<pre><code>if (strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest' ) {...}
</code></pre>

However, I don't see <code>$_SERVER['HTTP_X_REQUESTED_WITH']</code> in the <a href="http://php.net/manual/en/reserved.variables.server.php" rel="noreferrer">official PHP documentation</a>

And when I try to do the following:

<pre><code>echo $_SERVER['HTTP_X_REQUESTED_WITH'];
</code></pre>

Nothing is outputted.

Am I doing something wrong? Because I'd really like to be able to use <code>$_SERVER['HTTP_X_REQUESTED_WITH']</code> if it's available.

Does $_SERVER['HTTP_X_REQUESTED_WITH'] exist in PHP or not?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋 

腾讯云代码助手

CODING DevOps

Cloud Studio

SDK中心

API中心

命令行工具

在整个Internet上，甚至在Stack Overflow上，人们都表示，检查请求是否为AJAX的一个好方法是执行以下操作：if (strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest' ) {...}但是，我在中没有看到$_SERVER['HTTP_X_REQUESTED_WITH']当我尝试执行以下操作时：echo 

问PHP中是否存在$_SERVER['HTTP_X_REQUESTED_WITH']？
EN

回答 7

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问PHP中是否存在$_SERVER['HTTP_X_REQUESTED_WITH']？EN

回答 7

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问PHP中是否存在$_SERVER['HTTP_X_REQUESTED_WITH']？
EN