[SOLVED] stopping execution of php code within a file in a broswer

MrUmunhum · 10-21-2012, 06:26 PM

Hi group,

I am having a problem displaying a php file in a browser. If I just download the file, the browser executes it. So I have writting a php script to view the code but it execute the file in the browser and does not show all of the file. My script looks like this:

Code:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/plain; charset=UTF-8">
<?php
header('Content-Disposition: attachment; filename='.basename($file));
$prog = $_GET[ 'prog' ];
echo "<title>$prog</title>\n</head><body ><pre>";
echo "$prog\n";
$Home = $_SERVER['DOCUMENT_ROOT'];
$path = "$Home" . "$prog";
readfile( "$path" );
?>
</pre> </Body> </html>

I am using "<pre>" but the php code in the "prog" is still executed.

Any ides on how to stop executing the php code in the downloaded file??

Thanks for your time.

r0b0 · 10-22-2012, 06:51 AM

I am sorry, I have a very hard time understanding your problem. You want to be able to view PHP files without them being executed as PHP by the server?
If your web server is configured to execute .php files, it will execute them. You can disable the PHP module for the whole web server or a part of it. Or you can rename the php files to some other extension so that they are not executed.
If I'm misunderstanding you, please re-phrase your question.

eSelix · 10-22-2012, 07:35 AM

readfile() does not execute your code provided that your $_SERVER['DOCUMENT_ROOT'] does not contain "something://". Can you paste example file and contents of received file?

MrUmunhum · 10-23-2012, 01:34 PM

Hi guys,

My problem is not with the server, it is doing what it is supposed to. The problem is on the browser side. When the browser sees the "<?php" code in the data, it assumes that it should process that code.

If you go to: http://64.124.13.3/Fritzing/PerfBoard.htmlScroll down to "The Script" header and click on "View perf.php". When the page is loaded, there is code missing in the browser window but if you view the page source, all of the code is there. I have tried both Seamonkey ( Mozilla ) and Firefox. I am uncertain why the browser is executing any code, I thought that happened only on the server side?

All I want is to view the php code in a browser's window. I though by defining

Quote:

content="text/plain;

that would tell the browser "this is just plain text"?

Does that make my problem clearer? Sorry for the confusion.

MrUmunhum · 10-23-2012, 02:38 PM

OK, guys. I have a fix, it is not pretty but here it is:
Change

Code:

readfile("$path");"

to:

Code:

$Lines = file( "$path" );
foreach ($Lines as $Line) {
    echo htmlspecialchars($Line);
}

Noway2 · 10-23-2012, 03:31 PM

Quote:

When the browser sees the "<?php" code in the data, it assumes that it should process that code.

As an important point of clarification, the browser is not PHP aware and does not interpret or process your code. This is purely a server side function. The PHP interpreter on your server converts the code into HTML or rather generates the HTML from your PHP code. The reason your code is being executed is that any code between the <?php and ?> tags will be interpreted before it is passed through to the browser.

Your fix, reads the raw text file into strings, which you are then echoing, while the htmlspecialchars function converts things like quotes and ampersands which are part of the code, into entity references that will display in HTML (what is being echoed).

salasi · 10-23-2012, 03:50 PM

Just as a matter of interest, what are you trying to achieve that 'View Source' (or 'Source') in the browser doesn't do?

MrUmunhum · 10-23-2012, 05:56 PM

Quote:

Originally Posted by salasi

Just as a matter of interest, what are you trying to achieve that 'View Source' (or 'Source') in the browser doesn't do?

I am trying to give the user the option of viewing the php code in a browser window before downloading it. Many people are very paranoid about downloads.

MrUmunhum · 10-23-2012, 06:04 PM

Quote:

Originally Posted by Noway2

As an important point of clarification, the browser is not PHP aware and does not interpret or process your code. This is purely a server side function. The PHP interpreter on your server converts the code into HTML or rather generates the HTML from your PHP code. The reason your code is being executed is that any code between the <?php and ?> tags will be interpreted before it is passed through to the browser.

Your fix, reads the raw text file into strings, which you are then echoing, while the htmlspecialchars function converts things like quotes and ampersands which are part of the code, into entity references that will display in HTML (what is being echoed).

Before this experience I would have agreed with you. Now I don't. The browser does do something with php code in a web page, as well as CSS and Java. Further testing is needed for me.

eSelix · 10-24-2012, 03:42 AM

Quote:

The browser does do something with php code in a web page...

Yes, it do something, but does not execute this code, bucause it just does not understand PHP, like Noway2 wrote ealier. CSS, Java (if special plugin is enabled), HTML, JS (if not blocked), but not PHP. What you saw on browser was an attempt to interpret this <?php ..... ?> as HTML tags. So, you didn't saw what was between this tags (because this is not html and was hidden), and saw the rest.

If you want to display unknown text in the browser you need to use htmlspecialchars() functions. All these special chars, like <, >, &, etc. are interpreted by browser and you did not see them like you want. Also maybe you been interested about a function highlight_file().

As you are beginner in PHP advise you to read about security, like filtering user data. For example

Code:

$prog = $_GET[ 'prog' ];

here a malicious user can read any file from your serwer.

chrism01 · 10-24-2012, 06:57 AM

Like eSelix and Noway2 said, php is purely a server side language.
If you try to actually deliver the php code to the browser it may try(!) to run it, but it won't know how.