This is my method to handle XMLHTTPRequests.

Avoids mysql request, foreign access, nerves user, double requests.

jquery

var allow=true;
var is_loaded="";
$(document).ready(function(){
....
$(".xx").on("click",functio(){
         if(allow){
           allow=false;
           if(is_loaded!="that"){
             $.post("job.php", {job:"that",word:"aaa",number:"123"},function(data){
               $(".aaa").html(data);
               is_loaded="that";
               });
             }
           setTimeout(function(){allow=true},500);
           }
....
});

job.php

<?PHP
ob_start('ob_gzhandler');
if(!isset($_SERVER['HTTP_X_REQUESTED_WITH']) or strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) != 'xmlhttprequest')exit("bad boy!");
if($_POST['job']=="that"){
  include "includes/that.inc;
  }
elseif($_POST['job']==
   ....
ob_end_flush();
?>

that.inc

if(!preg_match("/\w/",$_POST['word'])exit("bad boy!");
if(!is_numeric($_POST['number'])exit("bad boy!");
//exclude more.
$path="temp/that_".$row['word']."txt";
if(file_exists($path) and filemtime("includes/that.inc")<$filemtime($path)){
  readfile($path);
  }
else{
  include "includes/openSql.inc";
  $call=sql_query("SELECT * FROM that WHERE name='".mysql_real_escape_string($_POST['word'])."'");
  if(!$call)exit("ups");
  $out="";
  while($row=mysql_fetch_assoc($call)){
       $out.=$_POST['word']." loves the color ".$row['color'].".<br/>";
       }
  echo $out;
  $fn=fopen($path,"wb");
  fputs($fn,$out);
  fclose($fn);
  }

if something change at the database, you just have to delete involved files. Hope it was English.