At my previous company we had a shared $_SERVER['shared_code_dir'] directory that was usable by all our sites on our server. I know in php you can't use the include() function with an https web address for security reasons. But we had a directory set up that could be used securely. Does anyone know how to set that up? I apologize if this isn't completely clear.

1 Answer 1


Although it's not recommended for security reasons, particularly if it's an internet-facing website because it might get abused if coded improperly, it can be configured!

You'll need to enable allow_url_include in your php.ini configuration for it to work.


  • Hey Luis. Thank you. I'm aware of that setting, but I was hoping there was a way to create a global $_SERVER variable that's secure without flipping that switch in the php.ini file since I know that is a security risk. Is there any workaround to that variable?
    – Guy
    Aug 11, 2021 at 23:09
  • "it's not recommended for security reasons" - it's also not a very practical solution. URL includes are not intended for including arbitrary PHP scripts. When you include a PHP script using a URL, you are making an HTTP request and consequently including the output (the HTTP response) that the PHP script produces, not the PHP script itself, into the receiving PHP script. Most PHP files (the kind you would want to share in a library of includes, such as a group of functions or classes) don't output anything, so the include(<some-URL>) statement includes nothing.
    – MrWhite
    Aug 12, 2021 at 0:29
  • ... to include an arbitrary PHP script X.php using a URL wrapper, you would need to include a secondary script Y.php that fetches X.php and returns this in the HTTP response. Or, you use a none .php ext for your included files, so they aren't processed at the source server (or disable PHP altogether and have the server serve static resources only). Needless to say, due to the HTTP request, this is going to be slow, so local caching of this file(s) would be required. Anyway, this is all a bit academic. If all sites are on the "same server" there is no need to use URL wrappers.
    – MrWhite
    Aug 12, 2021 at 0:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.