[JkWhoSaysNi]

Actually I found a way to help detect whether it's graal or not.

Graal does not set most of the HTTP variables. HTTP_ACCEPT, HTTP_ACCEPT_LANGUAGE, HTTP_ACCEPT_CHARSET, HTTP_KEEP_ALIVE, HTTP_CONNECTION are all not set by graal, you could check to make sure these are all not set in your php script.

That should be enough to stop most wannabe hackers. Of course it would be possible to mimick this behaiviour using cURL or through another scripting like php or perl (WWW:mechanize could do this with ease, unfortunatly).

If functionaility was brought in so we could set one or more of these variables ourselves we could make it a lot more secure because we could use these values as checks. You could set them as something in graal and check them in your php script. (of course doing this from clientside would still leave it open to packet sniffing, but no moreso than a requestmysql() function.)