Wrapper is disabled in server configuration allow_url_include = 0

Question

I am trying to get the contents of a page with an AJAX call. I have a series of links inside the page wrapper. When I click on the link, it loads a JavaScript function that extracts the contents of the page from the php script. In this case, I develop my localhost , but during production the script will be in the same root folder and domain as the file that makes the AJAX call. I use the answer as the content for the div . The content is not pure php , and I mean that while it is being generated by php, it has HTML elements like div and spans. This is basically the material that goes between opening and closing body tags. Because of this, I'm not sure I can just use json_encode .

Instead of loading content into a div , I get the following error:

Warning: require_once () [function.require-once]: http: // wrapper is disabled in the server configuration allow_url_include = 0

After reading on allow_url_include it seems like this is usually disabled by default. I assume that this feature allows you to make serious attacks on the site. This is true. If so, how can I get the contents from another file?

I tried using the JQuery download function:

 $('#content').load('pages/test_page.php'); 

but with exactly the same results.

It drives me crazy! TIA.

EDIT: I think maybe I found a problem; the php file that AJAX retrieves the content uses require_once . The file that it requires is located on the same server in the same root folder, but it was one directory up. HOWEVER, this creates a new problem: I get the content, but not completely. For example, in a file I have the following:

 Title: <?php echo $details['title']; ?> 

I get only the first letter, and this is true for other php content that I echo .

Answer 1

allow_url_include only affects include() and require() , you can use the PEAR module HTTP_Request2 or curl to get web pages.

Using include() for remote web pages is considered "bad practice" and may pose a security risk. For example, if you use include($var); , and some attackers manage to replace $ var with http://hacksite.tld , they can "enter" the code ...

Answer 2

Don’t worry, just use file_get_contents() , then write a new file in your documents with the content you received, and then include file in your file. the file that you have included now is ready for any changes using css , javascript , etc. This is basically what the wrapper does.

Answer 3

because you are using the full url. try instead:

 $('#content').load('test_page.php');