This error is probably because /modules/.htaccess has "deny from all". Don't circumvent this security but call a php file outside of this directory.
Off the top of my head you may want to start with one of the Block examples like:
- skin/common_files/modules/Customer_Reviews/ajax.rating.js (calls loadBlock for rating_bar)
- skin/common_files/js/ajax.js (loadBlock calls get_block.php)
- get_block.php
- modules/Customer_Reviews/func.php (func_ajax_block_rating_bar())