带有令牌的Ajax

How would you go about using tokens with the following?

$('#DIV').load('child.php?id='+id);

So that you couldn't access child.php straight from the browser and type child.php?id=1

If this is not possible with tokens would there be any other way?

Thought about XMLHttpRequest as follows:

var mygetrequest=new ajaxRequest();
mygetrequest.onreadystatechange = function(){
    if (mygetrequest.readyState==4){ 
        if (mygetrequest.status==200 || window.location.href.indexOf("http")==-1){ 
            document.getElementById("DIV").innerHTML = mygetrequest.responseText;
        } else{ 
            alert("An error has occured making the request");
        }
    }
}
mygetrequest.open("GET", "child.php?id="+id, true);
mygetrequest.send(null);

Many thanks.

You could use jQuery post to send the parameters "behind the scene" and then check if the request was sent from a certain location or IP within the actual php file. If the location or IP does not have the authority to access it, simply output an error using e.g. the die() method before anything else has been output.

What you need is to check if the request is an ajax request (from load()) or not, this can be done by the following:
child.php:

if(isset($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest') {
    // it's an ajax request validate id and continue!
} else {
    // this is not an ajax request, get out of here!
}