title: Stop users inputing AJAX data by visiting the endpoint URL
body: <p>I have a simple form that sends form data to update.php which then inserts the data into a table in a MySQL database.</p>
  
  <pre><code>$.ajax({
    url: '/actions/update.php',
    type: 'post',
    data: {
      name: 'name-data',
      description:'description-data'
    },
    success: function( data, textStatus, jQxhr ){
      console.log(data);
    },
    error: function( jqXhr, textStatus, errorThrown ){
      console.log(errorThrown);
    }
  });
  </code></pre>
  
  <p>The form works and the data is added into the database perfectly. The problem is that in theory, if the user knows the url of where the data is being posted to (which they may if the look at the source code) then they can visit that URL and add records bypassing the form. e.g. visiting /actions/update.php will add a blank record to the database.</p>
  
  <p>Is there away to block users to that file/directory while still allowing data to be posted to it?</p>