Want to include php file in WP content. Some parameters will be different depending on the include.

I want to write 1 include shortcode. I do not want to write different include functions for each include file.

Example shortcodes:

[include filepath='/includes/dogs.php' color='black' size='large']

[include filepath='/includes/table.php' type='dogs' number='5' sort='desc']

After the function includes the file, all other parameters are passed to THAT file. Is this possible?

This code is close except for grabbing all other parameters for the include:

// SHORTCODE - Include File
// http://www.amberpanther.com/knowledge-base/using-the-wordpress-shortcode-api-to-include-an-external-file-in-the-post-content/


function include_file($atts) {
  //check the input and override the default filepath NULL
  //if filepath was specified
  extract(shortcode_atts(array('filepath' => 'NULL'), $atts));
  //check if the filepath was specified and if the file exists
  if ($filepath!='NULL' && file_exists(CHILD_SS_DIR.$filepath)){
  //turno on output buffering to capture script output
  //include the specified file
  //assign the file output to $content variable and clean buffer
  $content = ob_get_clean();
  //return the $content
  //return is important for the output to appear at the correct position
  //in the content
  return $content;
//register the Shortcode handler
add_shortcode('include', 'include_file');

Want something safer than using a PHP wrapper plugin! Thank you in advance.

Clarifications The above is example code, I'm not sure I'll even use it. Shortcode parameter 1 is the include file. Any parameter following this should be accessible to the include itself.

Why do this? I don't know any way of including content from an DB or file outside WP without using a risky PHP interpreting plugin like Insert_PHP or Allow PHP in Pages. These plugins allow any PHP code to run, a security risk. I only want to pass parameters to each include file.

Explain your Example

[include filepath='/includes/dogs.php' color='black' size='large']

Filepath is the include (dogs.php). When dogs.php is included, $color = "black" and $size = "large" for the code on dogs.php

I want the function to pass any parameters after filepath to the include. This means I don't have to write a function for each different include.

This is a Bad Idea

Please offer a better solution. I am not a WP developer. I have enough PHP knowledge to write custom functions, but admittedly lack a comprehensive understanding of all things WP.

The basis for my question was observing many WP plugins with shortcodes. They essentially do I what I am asking: parameters are passed and content is produced.

Thanks in advance for your time.

  • I don't understand "all other parameters". can you show a example ? – mmm Oct 22 '17 at 17:01
  • You want to include php-files, but want something safer than including php files? – janh Oct 22 '17 at 17:08
  • 1
    what a horrible idea. regardless that this way it will be easy for you to break the site without being able to recover, and you will not be able to maintain the code, there is the simple fact that shortcodes should be content macos and not a half arsed programming language – Mark Kaplun Oct 22 '17 at 17:49
  • @mmm I provided examples shortcodes above. First parameter is the include file, anything after should be passed to the include. – bpm-jax Oct 22 '17 at 17:58
  • 1
    you know in advance what your includes are going to do, just have each of them register its own shortcode. With a "formal" restrictive type of API a clearly defined shortcode attributes will force you into, it is less likely that you will have to hunt for their usage to change it. – Mark Kaplun Oct 22 '17 at 19:28

Thanks for your comments and guidance. I implemented solutions which didn't reinvent the wheel.

The complication was finding a way to remove the [insert_php][/insert_php] wrapped code from pages and posts and still preserve the content and user experience.

Custom Template Pages

Pages and Posts which were almost entirely PHP were made into custom template files. These were placed into my child theme folder. Old posts and pages were updated to the custom templates.

For large websites, I suggest writing a command line script to bulk update post templates. Or, use a good plugin.

Created Short Codes for Content Snippets

All instances of PHP includes, tables and DB calls within posts and pages were rewritten as short codes. These codes were added to my child theme's functions.php file.

This preserved essential tables, ads and images. Also, I removed text from within the PHP wrapper and placed it back into the WP content. This makes for much easier content management and integration with helpful plugins like Yoast SEO.

Easier to update content

I've found periodically re-coding my content functions improves efficiency and maintenance. It's similar to editing and rewriting written prose.

Making these changes was lengthy. However it will be much easier to update content snippets in the future!

Faster Website

Removing the [insert_php][/insert_php] content and plugin improved server performance and page speed. This is critical for SEO. Google Page Speed Insights noted a slight but noticeable improvement in server response time, roughly 0.30 ~ 0.23 for most pages.

Previously the server had to process all WP PHP, then run my own PHP wrapped inside each post. This was redundant and wasted time.

More Secure

Running a PHP wrapper inside WP content creates a substantial security vulnerability. Remember, these wrappers allow any PHP code to be executed, including MySQL, Exec, etc. commands. This is dangerous even if you have secured your WP site and database.

Now my sites are much safer. As an aside, I suggest using 2 Factor authentication for WP login. If someone gets in and runs PHP code (or installs a PHP wrapper plugin and subsequently runs code) you could be in big trouble!

2 Factor login adds an extra layer of security even if you password gets compromised. I recommend a plugin with Google Authenticator.

Do PHP Plugins Have Any Valid Purpose?

At this point I'm not sure. Given immense security risks, I wouldn't recommend them for large, high traffic websites.

I definitely would not recommend them if you're including DB logins, passwords and SQL queries to non-WP DBs in your code. If you must, make sure your DB user is limited to one database and "SELECT" queries. Do NOT give such users global privileges.

They might be helpful for testing. It is much easier for newbies to use these plugins while experimenting with content and design ideas than custom-coding a template. But I would highly recommend doing so after testing is done.

Finally, if it is possible to limit PHP commands and output, these plugins might be less risky.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.