Down PHP file via browser ??

[sb5...@yahoo.com]

Is it possible to download/copy a PHP file through a browser ?

(Sorry if it is a stupid question; I don't know and curious, wishing
to hear from experts.)

Thanks.

[Iván Sánchez Ortega]

sb5...@yahoo.com wrote:

> Is it possible to download/copy a PHP file through a browser ?

No.

(Unless the web server is badly configured, or the webmaster wants people to
be able to download raw .php files, which is not the case most of the time)

--
----------------------------------
Iván Sánchez Ortega -ivan-algarroba-sanchezortega-punto-es-

No me simpatizaasssss!

[trookat]

No such thing as a stupid question.

DISCLAIMER **
I am assuming that you are not evil and just trying to take a peek at
someones code without it being normally available, so I'm not going to
cover ways to get the source by exploiting buggy code. If you have a
question regarding your own code and to stop this from happening, then
please post it so we can gave a look

There are two ways to look at your question from a legit point of view
so i have answered it.

1.)
Simply pointing your browser at the url only gives you the executed
result of the script

unless the file is
1) not executed by php and the server just displays it as plain text
2) the script has security flaws that could be exploited to show code
3) available for regular download in a zip/tar or is available on the
persons site embedded in a <pre></pre> or similar way

then the answer is no

2.) if you have a php script and you want people to be able to look at
the live source just open the php file and print it to the browser

<?php

//my neat php, here everyone have my code!! yay!

print '<pre>'.file_get_contents('index.php').'</pre>';

// do more stuff here
?>

if I have misunderstood your question please provide more details.

regards
trookat

[sb5...@yahoo.com]

Some of my PHP files have passwords in there. I am a bit concerned
whether there are know ways to see them.

Thanks.

[Jerry Stuckle]

If your webserver is configured correctly, no.

But the safest way is to keep all such information in a file above the
web root, where it can't be directly accessed from the web. Then
include it as necessary.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstu...@attglobal.net
==================

[sb5...@yahoo.com]

New idea to me.

But when I "include" it in PHP file, doesn't the file content appear
in the PHP file as well ?

Thanks.

[FutureShock]

Not necessarily. Unless you output it manually or not have your error
settings correct for a production server, the included code will be
processed at the server lever BEFORE it is sent out to the bowser.

Most of the actual PHP code is never actually seen by the browser.

For example:

<?php
echo "FooBar";
?>

All your browser sees is:

FooBar

No <?php, echo, quotes, or ?>.

Scotty