securing a jquery ajax to php connection -

my ajax code is:

$.ajax({     type: "post",     url: "save.php",     data: {         name: $(this).attr('name'),         value: $(this).val(),         id: <?php if(!empty($_session['user'])) echo $_session['user'];?>     } }); 

and in save.php i'm checking condition:

if (empty($_server['http_x_requested_with']) || $_session['user']!=$_post['id']){     //then show error } 

is correct method prevent unauthorized call save.php?

in general..

anything @ client side insecure. therefore, script may called @ time using set of parameters.

protecting specific script

therefore, need prepare @ server-side, verifies valid @ later point of time.

let's call security-token. security-toke needs sufficiently long , random string. security-token need non predictable. in case, server-side application can source of token.

save security-token user's session , pass along client. associate security-toke script call protected. session might have property:

$_server[ 'sys$securitytokens' ]    = array(      'ahssd67sdsjdh/d6wehsd'         => array( 'script' => 'sensiblescript.php',                  'params' => array( 'kid' => 3, 'var5' => 12 )                ),      'ksd87sd78sdsfk(ddf/sd'         => array( 'script' => 'someohtersensiblescript.php',                  'params' => array( 'value' => 'welcome!' )                )      ); 

note, structure associates security-tokes script-names , valid parameters called later on.

if client needs call script using javascript, passes security-token server.

at server side...

if sensible script request comes in , correct security-token part of request, remove security-token session , execute script.

if sensible script request comes no security-token, reject request.