How to verify JQuery/AJAX referer to prevent CSRF?

Question

if ($_SERVER['HTTP_REFERER'] == "????")

What would the HTTP_REFERER be if this page was reached by a JQuery $.post request?

Answer 1

try

strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest')

Note That not all servers provide this variable

and you can read this Detecting Ajax in PHP and making sure request was from my own website