Allow PHP file to be requested by javascript but not directly from browser

You can check the HTTP header X_REQUESTED_WITH is present and has a value of XMLHttpRequest. This is not non-standard header but most JavaScript frameworks, including jQuery, Prototype, and mootools follow this convention.

In PHP you can access it $_SERVER['HTTP_X_REQUESTED_WITH'];

for example:

if(!empty($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest')
{
 // do something   
}

The javascript is running in the browser. It makes its requests through the browser. So, No, there's no way to access a page through ajax but not directly from the browser.

No, not directly. You can call other script (PHP or whatever) that will either "call" your script with include or e.g. with fopen or curl.

Nothing can access files above public_html, because the web server will not serve them. Doing so would have obvious security vulnerabilities, like being able to view any file on your filesystem.

If you want to restrict the file to only being able to be loaded via your javascript, I would think you'd want to look at the $_SERVER['HTTP_REFERER'] variable in php. This should be set to the page the javascript is located on when it is being accessed properly. If it is anything else or empty, the user is accessing it in some other manner.

Using this method shouldn't be relied on for security however, because the referer can be spoofed with the right tools.

Since direct browser access to a page is a GET request by PHP, here is a very basic access control method to keep someone from inadvertently going directly to upload_a_file.php:

In your jquery script, use an ajax request with type "POST":

$.ajax({
    url:      "../upload_a_file.php",
    dataType: "json",
    type:     "POST"
});

and use this in your upload_a_file.php:

if ($_SERVER['REQUEST_METHOD'] == "POST") {
    // upload a file
} else {
    header("Location: http://example.com/myPublicUploadPage.php");
    die();
}