I have the line
xmlhttp.open("GET","file.php?id=4",true);
This does not work since file.php is not in the same folder but rather in a different private folder not visible to the public.
Is there a way to use the open function to open a file in a different folder?
That's fundamentally impossible.
If you want to send an HTTP request to it, it must be visible to the public over HTTP.
You can only request files from within the public webspace. To access files outside the public webspace you need a script in the public webspace that can fetch the contents from the private folder, e.g.
<?php // file.php in the public webspace
$allowedFiles = array(
1 => '/path/to/private/space/on/server/file1.txt',
2 => '/path/to/private/space/on/server/file2.txt',
3 => '/path/to/private/space/on/server/file3.txt',
4 => '/path/to/private/space/on/server/file4.txt',
);
$id = filter_var($_GET['id'], FILTER_VALIDATE_INT);
if (isset($allowedFiles[$id])) {
readfile($allowedFiles[$id]);
}
Now when you do
xmlhttp.open("GET","file.php?id=4",true);
the script will send the content of
/path/to/private/space/on/server/file4.txt
to the client.
Note that readfile will not execute the file contents. If you need to send the results of a PHP script, you have to use include instead of readfile. Please refer to the Manual for details.
The above approach is effectively the same as most of the frameworks nowadays use. You have one single script that acts as a gateway into your application (kind of like a Front Controller pattern). This script accepts any and all requests (think mod_rewrite) to your application and is the only publicly accessible PHP file. It will bootstrap your application and then determine from the URL (or whatever you seem fit) what file, usually a controller when using MVC, in the private space should be instantiated and called.
