AJAX request authentication to PHP script
Prefer mt_rand() to rand().
Just a comment: your usage of tokens is similar to using nonces. There are established nonce generation libraries for PHP, and I suggest you take a look into them.
HTTP_X_REQUESTED_WITH is in general not a 100% reliable way to detect AJAX-ness. However, jQuery sends this header with its AJAX calls, so you should be okay. I'd suggest getting rid of the is_ajax in your request data though.
Your input element is at best confusing, and at worst messy. Why is Deactivate paired with YES, and Activate with NO? I'd prefer just using deactivate and activate as the button values, and templating inline:

&lt;td&gt;&lt;input type="button" class="active_button" name="&lt;?= $article_id ?&gt;" value="&lt;?= $article_active ? "de" : "" ?&gt;activate" /&gt;&lt;/td&gt;

activateDeactivate isn't a very good name. Maybe setActiveStatus or something?