Cross-domain AJAX question

[LLLLLLL]

So, I understand if I add the following, that other domains can use the script via AJAX:

 

<?php
header("Access-Control-Allow-Origin: *");
...
code that does something

 

My question is: does this line have to be at the top of the file? Does it matter where this line is located?

 

I was thinking of doing something that lets a user configure their software's "allowed" domains, so, something like this:

 

<?php
$urls = db::some_query_to_see_allowed_origins();

if ( !empty( $urls ) )
    header("Access-Control-Allow-Origin: $urls");

...
code that does something

 

Would something like this work?  I don't know at what point the "cross-domain" errors occur, so I don't know where the header line needs to be.

 

[scootstah]

It can be anywhere in the code as long as it is before any output. But, the top of the script is a good place for it.

 

Make sure multiple URL's are comma-separated.

[LLLLLLL]

"Before any output" - very good! That helps me.

 

So I will pretty much modify my code as I stated; the line won't be the very top of the file, but it will be very close.

 

Thanks!