Printable View
Anyone know how do review the php code in server? Normally the php code will be process by the server before sending back to client. Is that anyway from a client that i can request the source code from the server? Just want to know is that impossible. Thanks in advance.
A references web site. Search on google ^_^. But still i am interested to know if any ways that could used.
http://www.dynamicdrive.com/forums/a...hp/t-8062.html
Seems like if we request with the http or https is imposible to get the source code. Only if we used other protocols like ftp or SFTP we can get the raw files. Which means that the code is acctually secured by the protocols it self. But is there anyway to prevent the server to process the php page and sent the raw code? Should be no. That was secure by apache. Anyway, I am still hopng for an answer.
After the script is parsed by PHP itself, it sends the page to the webserver, which then serves it to the client. If you used fopen() or file_get_contents() to open a PHP script on an external link (ie: http://www.domain.com/index.php), the script will be parsed by PHP and the output given to YOUR PHP script would be only the HTML given out by domain.com/index.php, if that makes any sense to you. The only way you could possibly get the source of another page online would be if your script was physically located on the same server and you had the permissions to browse to that directory on the file system (ie: C:/webroot/index.php, or /usr/home/web/index.php), and then opened the file directly. you can't do what you're trying to do with the HTT protocol. I hope I got most of that right.
however, if you're looking to make a script that just prints out the source of another script on YOUR server to let people view it through their browser, it's easy: just use fopen().
So does it means that there is no way we can view a php site through HTTP or HTTPS protocols from the client site? The server will process all the php script and pass back only plain HTML to the client. The fopen is script from server, not client...
I didn't say fopen() was used by a client.. :/
no, you can't get the source of a PHP file using HTTP.
Thanks but the answer is disappoint.
Can you imagine how much of a security issue it would be if server-side code that handled sensitive data could be requested from a client using simple HTTP?
If you want, you can add something like this to the top of a file that you don't mind showing the source for:
and call the file using ?source as the query string.PHP Code:if (isset($_GET['source'])) {
readfile(__FILE__);
exit();
}
I get your point, we shouldn't able to view the source from client. I am just curious on how people can hack into server by using only HTTP or HTTPS protocol. Thanks anyway
You can't by principle, only if there is some security vulnerability in the web server.