Question

Currently, I’m referencing images, stylesheets etc. like this on my home server:

http://localhost/igniter/assets/images/

However, this requires allow_url_include to be set to On in my php.ini file. I read that, as far as possible, allow_url_include should be set to Off.

To do that, I’d need to alter my images path to something like:

wwwroot/igniter/assets/images/

Basically, how can I reference the root of my hosting account?

Answer 1

allow_url_include is about being able to pass URLs as filenames to include, require, and their brothers. It has nothing to do with referencing things from the HTML. To illustrate, this is a piece of code that will behave differently based on this settings:

<?php
include 'http://www.example.org/constants.php';

echo SOME_CONSTANT_DEFINED_IN_CONSTANTS_PHP;

If you allow URL includes, it will make a HTTP request to http://www.example.org, download the output of constants.php, and include that as PHP source; if you disallow URL includes, it will fail to include anything (and react according to your error_reporting setting).

Referring stylesheets, images, etc. on the client (that is, from the HTML you output), such as in this example:

<?php
do_some_stuff();
?>
<img src="http://www.example.org/images/img000.jpg" />

will work fine either way.

Note that scripts are subject to the Same Origin Policy implemented in modern browsers, but that’s a different story altogether.