0

I am a wordpress newbie messing around with a wordpress installation on localhost using XAMPP and I've encountered a weird problem that I can't find any information on. The problem is that every time I try to make an AJAX request it takes exactly 30 seconds before it completes and executes the callback function.

What I'm doing is embedding a jQuery AJAX request directly into a page in the page section using the editor in "text" mode. There I insert some regular HTML and then something like this:

<script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js"></script>
<script>
alert("Before AJAX");
$.get("[insert_php] echo get_template_directory_uri();[/insert_php]/my_php/test.php", function(responseText) {
    alert("Inside");
});
alert("After AJAX");
</script>

When go to the page the two alerts outside pop up instantly and the one inside pops up after 30 seconds. I used Firebug to confirm that it's always 30 seconds until it completes. I should also point out that the first few times I tried making an AJAX request it did work as expected, but now it always takes 30 seconds.

  • 1
    what's the [insert_php] shortcode? If you have a plugin that allows you to put PHP and javascript inside posts, you've created a massive security hole. You should also use the jQuery that comes with WordPress rather than adding your own or the Google CDN version – Tom J Nowell Oct 4 '15 at 22:56
  • The shortcode is from a fairly popular plugin called "Insert PHP". But why would inserting PHP into a page like that be a massive security hole? I'm pretty sure it's still executed on the server and sent to the client, as usual. Please explain. Regarding jQuery, I will try googling how I can use Wordpress' jQuery instead. – Just some guy Oct 5 '15 at 10:38
  • Try copy pasting a PHP shell into a post, that post will provide anyone with full server access. Anything that evaluates or allows for the evaluation of strings as PHP at runtime is a massive security risk. Anybody who has access to your database can compromise your filesystem, with the right setup, that may not even be necessary. Anybody who can write a post, even if it's via a contact form can gain full control over your server. If you need to run PHP and insert the result into your posts use the shortcode API. What you're doing is incredibly dangerous. – Tom J Nowell Oct 5 '15 at 13:05
  • You are talking as if this plugin would allow people to paste PHP code into comments or whatever. That's not the case, this plugin just let me write small snippets of PHP inside the admin interface when editing pages. – Just some guy Oct 5 '15 at 16:07
  • You should use the short code API if you need custom logic and output in a post. AJAX should be done via the WP AJAX api. On a well secured server it should be impossible to run code that takes text from the database and evaluates it as PHP, it's incredibly dangerous – Tom J Nowell Oct 6 '15 at 13:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.