Question: 1. Why do we write \*bufp = buf since both are arrays so in my opinion it should be:

```
static char bufp = buf;

```
2. How does \*bufp "know" from which position to start displaying ? It is not initialized to zero in any way. After assigning `buf` to `bufp` I'd expect that in return line it starts with the last entered char.
3. Is unsigned char modifier used here just to omit the case of `-1` being the input - meaning `EOF` on most systems?

```
#include "syscalls.h"
/* getchar: simple buffered version */
int getchar(void)
{
    static char buf[BUFSIZ];
    static char *bufp = buf; /* [1] */
    static int n = 0;
    if (n == 0) {            /* buffer is empty */
        n = read(0, buf, sizeof buf);
        bufp = buf;          /* ? [1] here it is written like in my question so which is true ? */
    }
    return (--n >= 0) ? (unsigned char) *bufp++ : EOF; /* [2] & [3] */
}

```

Answer: 
Either use an HTTP POST request, which can't be done just by entering a URL. (Though it can spoofed, or done via a form)

Or:

How about generating a kind of token on the server, getting it to the ajax code somehow, then passing it back in the ajax request.

Obviously they could still forge the request manually if they pull the token out of your page, but you issued them the token in the first place.

You could make the token single-use, time limited, or user-specific.
Make sure it contains some kind of checksum with a server secret to prevent people building their own tokens.
Do you want to prevent any unauthorized users to run the script or do you want to make sure that the script only can be run via AJAX calls?

For the first, you can just check if the user is logged in. The AJAX request uses the same session as the ordinary requests.

```
if (Auth::instance()->logged_in())

```

For the second you need to check the HTTP headers if it's an AJAX call. But note that this is not a safe way to do it as HTTP headers can be altered by the client and can not be trusteed.

```
if(!empty($_SERVER['HTTP_X_REQUESTED_WITH']) && 
strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest')
{
    //This is an ajax call
}

```

Unfortunately, there's no bullet proof or safe way to detect an AJAX request other than this.