You can setup sessions using the $_SESSION array, aswell as storing the session in a database. With this could impliment a 1 time only key system. This would mean that each page load is only good for one viewing. it would involve possibly sending a key along with every page load, or using cookies (probably a cleaner method). Then the script can check if the key matches the one on the server session, if so that page load is valid. You could also store the refering url (easily hacked) to ensure they have come from the same page aswell.
This is the kind of technique you would have to use with AJAX, but it can secure your site aswell. Meaning that a user is not trying to access the page from random places.
You would have to consider the fact that multiple browser sessions may be open on one browser. To get around this you could have a key pool per session, so say people have access to a history of 5 keys.
To be honest this isn't a required security measure, but it does enforce that a would be hacker be using a full implimentation of a browser to do their hacks. They couldn't just write a simple HTTP requester to do it.
This is the kind of technique you would have to use with AJAX, but it can secure your site aswell. Meaning that a user is not trying to access the page from random places.
You would have to consider the fact that multiple browser sessions may be open on one browser. To get around this you could have a key pool per session, so say people have access to a history of 5 keys.
To be honest this isn't a required security measure, but it does enforce that a would be hacker be using a full implimentation of a browser to do their hacks. They couldn't just write a simple HTTP requester to do it.