Member Avatar for anthonyjpv

Hi,

I have a pretty quick question regarding PHP code

if script is hidden from client's browser

and php code are rendered back as HTML to the user

is there a way ever that someone can view your code using say a browser plugin?

or getting your source file and the running that from your localhost?

i dont know if this is possible.

just being curious.

if its not, then whats the use of hiding the config file such as db username and pw from the root directory of your web server?

thanks in advance!

  • 4 Contributors
  • 3 Replies
  • 424 Views
  • 10 Hours Discussion Span
  • Latest Post Latest Post by Member #120589

Dani AI

Generated

Short answer: no — a browser or browser plugin cannot read server-side PHP source on a properly configured server. PHP is executed on the server and only the generated HTML/JS/CSS is sent to the client. To see the PHP source someone must first get the actual file (download it, get FTP/SSH access, or exploit a server misconfiguration/vulnerability).

That said, leaks do happen. Common ways source gets exposed: a PHP handler is missing so .php files are served as plain text; accidental backup files (file.php~, file.php.bak, file.php.swp) or .phps handlers are reachable; version-control folders (.git, .svn) or .env/config files are left in the webroot; Local File Inclusion (LFI) or other vulnerabilities let an attacker read files; mis-set permissions or shared-hosting isolation fails; or an admin accidentally uploads sources to a public folder. As noted, normal visitors can only see output — but as warned, misconfiguration changes that.

Practical hardening steps (complements ’s above-docroot advice):

  • Put credentials/config outside the webroot and require them from your scripts (e.g. require __DIR__ . '/../config.php';).
  • Make sensitive files non-world-readable (owner + webserver group only, typically 600/640 depending on your setup).
  • Prevent directory listing and deny access to dotfiles/backups. Example Apache snippet:
    <FilesMatch "(\.env|\.git|\.svn|config\.php|.*~)$">
<IfModule mod_authz_core.c>
  Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
  Order allow,deny
  Deny from all
</IfModule>
</FilesMatch>
  • Don’t commit secrets to VCS; add them to .gitignore. Use environment variables or a secrets store when possible. Remove any public phpinfo() pages after testing.

Quick checks if you’re worried: request a .php file and see if the browser downloads raw source or shows it as text; create a temporary phpinfo() test (remove it right away); scan for .git, .env, or backup files in your docroot; review webserver error/access logs. If any leakage is found, rotate credentials immediately.

Answer to the OP’s localhost question: yes, someone can run your code locally only if they already possess the source file — that requires a separate lapse (leak, access, or exploit).

Recommended Answers

All 3 Replies

Member Avatar for rch1231

Hello,

It really depends on how secure your Apache and PHP installations are configured. There are many options to make PHP more secure and suggested practices for making a site secure. It is possible to lock the system down so that they cannot be read but it is not always configured properly.

Member Avatar for gotboots

If your writing in php, no one can see your php coding. Only the sever administrator and the ftp access user, eg you, can see your php coding. The only part of the source code they could get is the html output that you have either echoed, printed or hard coded in. Your php is safe

Member Avatar for Member #120589

Ensure that any sensitive files are kept above the doc root.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.