Permission Denied When Using Javascript to Call a Template File

[bcdynamic]

Hi all:

I have a template file (includes/templates/theme_name/templates/tpl_index_quicksearch.php) that displays a few subcategory names as links.

I have another file in the same folder named 'tpl_subcats_ajax.php' that displays the subcategory description and products based on the category number passed to it. I know the code works, because when I include it in tpl_index_quicksearch.php, there are no problems.

Using jQuery.get(), I'm trying to call 'tpl_subcats_ajax.php' but nothing happens. My javascript is as follows:

$.get('includes/templates/theme_name/templates/tpl_subcats_ajax.php', { subcat: $(this).attr('id') }, function(data) {
	$('#quicksearch_content_desc').html(data);
});

Nothing is happening because I get a permission denied error when I try to access http://mydomain.com/shop/includes/te...bcats_ajax.php

If I place 'tpl_subcats_ajax.php' in the root of the shop/ folder, the jQuery call works but I cannot access the ZenCart DB from that location.

Is there a specific place I should be putting the 'tpl_subcats_ajax.php' file that won't give me a permission denied message and still allow me to access the DB?

Thanks!

[DrByte]

For very important security reasons, you CANNOT access PHP files under the /includes/ folder from a browser, and that includes ajax, javascript, and any other means.
You'll need to put your scripts someplace above the includes folder, perhaps just in the root of your store.

And, the location of the file has nothing to do with whether the database can be accessed.

[bcdynamic]

For very important security reasons, you CANNOT access PHP files under the /includes/ folder from a browser, and that includes ajax, javascript, and any other means.
You'll need to put your scripts someplace above the includes folder, perhaps just in the root of your store.

And, the location of the file has nothing to do with whether the database can be accessed.

Thanks for the reply!

I inserted the following code into my script and now it works to access the database; please let me know if this is a security problem.

require_once('includes/application_top.php'); 

-Brandon

[DrByte]

That's the most appropriate way.