Including wp-load.php causes fatal error inside a class method - php

Question

Im doing a direct .php call (ajax). Due to my classes, loading system, I would need to load wp-load later, not at the start.
So, if my file has only this:
include $_SERVER['DOCUMENT_ROOT'] . '/wp-load.php';
it runs ok. But if its wrapped inside a class:
class Paff
{
public function x()
{
include $_SERVER['DOCUMENT_ROOT'] . '/wp-load.php';
}
}
(new Paff())->x();
it dies with a fatal error:
PHP Fatal error: Call to undefined method stdClass::escape() in /var/www/wp-content/sunrise.php on line 11
I cant see any reason why!

Answer 1

It seems like you're trying to load a WordPress multisite outside of the normal parameters (judging by sunrise.php being the issue here). Try loading this file instead:
include $_SERVER['DOCUMENT_ROOT'] . '/wp-blog-header.php';
This skips index.php which defines the WP_USE_THEMES constant and assumes you're not loading the front-end of the site (at least not traditionally, which you're not).
That should load everything and in the right order for you now.

Answer 2

I also could not see anything wrong with your code. So I tested it with one change just for confirmation that it does work.
<?php
class Paff
{
public function x()
{
include $_SERVER['DOCUMENT_ROOT'] . '/wp-load.php';
echo 'wp-load.php included. ABSPATH=' . ABSPATH;
}
}
(new Paff())->x();
?>
It runs without error! and displays the following in the browser.
wp-load.php included. ABSPATH=D:\bronce/
I displayed the ABSPATH just to confirm that wp-load.php was included as it defines ABSPATH.
So this works as it should on my installation which is very standard as I just installed PHP a few weeks ago and I know I didn't change the defaults very much. So why does it not work on your system? It must be configured different. Is your system running any pre-execution handlers?
I just did a search for 'sunrise.php' which I originally thought was the name of your code. It may actually be an infection (or not) see https://premium.wpmudev.org/blog/removing-backdoor-exploits/. I think given its name it is configured to run as a pre-execution handler. Some plugins legitimately install pre-execution handlers, e.g. WordFence. Unfortunately, I did not install WordFence this time and I don't recall the name of its pre-execution handler.
I just read the source code to WordFence. It does install a pre-execution handler but its name is ABSPATH . 'wordfence-waf.php'. However, WordFence also has a reference to '.../wp-content/sunrise.php' apparently executed before multisite loading. Are you using WordFence? Is your site a multisite?
The important point is: The problem is not in your code but in a pre-execution handler. A pre-execution handler can be a huge amount of PHP code that can significantly change the PHP execution environment, which is why plugins such as WordFence use it to monitor your code execution.