20. PHP Include and Require

What you will learn

• How to reuse code across files
• The four statements: include, require, and their _once versions
• How to build file paths safely with __DIR__
• How to build a simple page template
• The security rules for including files

Why split code into files?

A website repeats the same header, menu, and footer on every page. Instead of copying them everywhere, put each in its own file and include it. Change the file once, and every page updates. Functions and settings can be shared the same way.

The four statements

Use require for files the page cannot work without, and include for optional pieces. Use the _once versions for files that define functions or classes, because defining the same function twice is a fatal error.

A first example

practice/
  index.php
  includes/
    header.php
    footer.php

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <title><?= htmlspecialchars($page_title ?? "My site", ENT_QUOTES, "UTF-8") ?></title>
</head>
<body>
  <header>
    <nav><a href="index.php">Home</a> | <a href="about.php">About</a></nav>
  </header>
  <main>

  </main>
  <footer>
    <p>&copy; <?= date("Y") ?> My site</p>
  </footer>
</body>
</html>

<?php
$page_title = "Home";
require __DIR__ . "/includes/header.php";
?>

<h1>Welcome</h1>
<p>This page is built from three files.</p>

<?php require __DIR__ . "/includes/footer.php"; ?>

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <title>Home</title>
</head>
<body>
  <header>
    <nav><a href="index.php">Home</a> | <a href="about.php">About</a></nav>
  </header>
  <main>

<h1>Welcome</h1>
<p>This page is built from three files.</p>

  </main>
  <footer>
    <p>&copy; 2026 My site</p>
  </footer>
</body>
</html>

An included file behaves as if its text had been pasted at that spot. It also shares variables with the page that includes it, which is how $page_title reaches the header. Every other page just changes the title and includes the same two files.

Why __DIR__?

__DIR__ is a built-in constant holding the folder of the file that is running. Joining it with a path makes the address absolute, so the include works from any folder.

<?php
// Fragile: depends on where PHP was started
require "includes/header.php";

// Reliable: always relative to this file
require __DIR__ . "/includes/header.php";

Sharing functions

Put helper functions in one file, and load it with require_once, so it is never loaded twice by accident.

<?php
function e(string $text): string {
    return htmlspecialchars($text, ENT_QUOTES, "UTF-8");
}

function price(float $amount): string {
    return "$" . number_format($amount, 2);
}

<?php
require_once __DIR__ . "/includes/functions.php";

echo e("Tom & Jerry") . " costs " . price(4.5);

Files that return a value

An included file can use return, and the including line receives that value. This is a neat way to load settings.

<?php
return [
    "site_name" => "BeingXpert",
    "items_per_page" => 10,
];

<?php
$settings = require __DIR__ . "/includes/settings.php";

echo $settings["site_name"] . ": " . $settings["items_per_page"] . " per page";

What happens if a file is missing?

<?php
include __DIR__ . "/does-not-exist.php";
echo "Still running.";

With require instead, the script stops at that line with a fatal error and “Still running.” never appears. That is why require is the right choice for essential files.

Security rules

<?php
$allowed = ["home", "about", "contact"];
$page = $_GET["page"] ?? "home";

if (!in_array($page, $allowed, true)) {
    $page = "home";
}

require __DIR__ . "/pages/" . $page . ".php";

• Only include files you wrote and placed on the server.
• Keep files that hold secrets, such as database passwords, outside the folder the web server publishes, or block them in the server settings.
• Do not let uploaded files end up in a folder where they can be included or run.
• Give included files a .php ending. A .inc or .txt file may be shown as plain text to anyone who requests it, revealing your code.

How WordPress uses this

WordPress themes are built from included parts. get_header(), get_footer(), and get_template_part(), which this very site uses, are wrappers around the same idea.

Common mistakes

• Using a relative path without __DIR__, so it breaks when the page is opened from another folder.
• Using include for an essential file, so the page carries on half-built.
• Declaring a function in a file included twice. Use require_once.
• Blank lines after a closing ?> in an included file, which are sent as output and can break header().
• Including a path built from visitor input.
• Storing secrets inside the public folder.

<?php
// includes/greeting.php
function greeting(string $name): string {
    return "Hello, " . htmlspecialchars($name, ENT_QUOTES, "UTF-8");
}

<?php
// page.php
require_once __DIR__ . "/includes/greeting.php";

echo greeting("Sam");

Summary

• Include shared pieces such as headers, footers, and functions instead of copying them.
• Use require for essential files, _once for function files, and __DIR__ for reliable paths.
• Never include a path chosen by a visitor, and keep secrets out of the public folder.