here is the code I added to a folder inside my theme directory i.e wp-content/themes**/THEMENAME/audiounity/**

$data_file = unserialize(base64_decode(file_get_contents(' get_template_directory() . "/audiounity/website_setting.conf"')));

here is the error I got after viewing a post

Warning: file_get_contents( get_template_directory() . "/audiounity/website_setting.conf"): failed to open stream: No such file or directory in /home/unerdportfolio/public_html/wp-content/themes/frontier/audiounity/result.php on line 2

note: my folder name is audiounity


i used this code below the_content();

    include( get_template_directory() . '/audiounity/result.php' ); 


inside this result.php is where am trying to call ...get_template_directory() . "/audiounity/website_setting.conf"')));

  • 1
    Did you try w/o the apostrophes? – rudtek Jan 24 '18 at 21:52
  • No... I don't know about it yet. I don't really understand what you mean – unity ekeinde Jan 24 '18 at 21:53
  • Is audiounity the name of your theme? – Tom J Nowell Jan 24 '18 at 22:08
  • @TomJNowell audiounity is the name of my folder in the theme. theme name is frontier – unity ekeinde Jan 24 '18 at 22:11
  • 1
    is it a child theme? – rudtek Jan 24 '18 at 22:11

There are 2 problems:

include( get_template_directory() . '/audiounity/result.php' );

The result of this is likely:


The first line of the Codex entry for that function is:

Retrieves the absolute path to the directory of the current theme.

If it's a child theme, then you need to use get_stylesheet_directory. *_template_* functions always refer to the parent theme, *_stylesheet_* functions refer to the active theme

A Bigger Problem You've Missed

$data_file = unserialize(base64_decode(file_get_contents(' get_template_directory() . "/audiounity/website_setting.conf"')));

  • .conf files will be readable to all, anybody can download your themes .conf file, would it not make more sense to store it inside a PHP file as a PHP array?
  • unserialize will unserialize a PHP structure, which exposes you to a PHP object injection attack. Avoid serialising and deserialising PHP

If you want to store a configuration, you have 2 options:

  • use JSON, json_encode and json_decode
  • use a PHP array in a file

If you need to modify these files, don't, use them as defaults and store the changes in the database as options

  • config file already encrypted – unity ekeinde Jan 24 '18 at 22:30
  • serialising and base64 encoding isn't encryption, anybody can undo the transformation via <?php echo unserialize(base64_decode(file_get_contents('downloadedfile.conf' ) ) );, but if it's a PHP array in a PHP file, it becomes a non-issue. Encryption won't prevent the security problem either – Tom J Nowell Jan 24 '18 at 22:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.