Menu
Just casual paranoia. Let's say we have an index.php:
<?php
exit('Forbidden!');
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN">
<html>
<title>Can you see me?</title>
<script language="javascript" type="text/javascript">
alert("Welcome!");
</script>
<p>You got me.</p>
</html>
Can an external user somehow reach the "Welcome!" message? And why yes/not?
Any means are valid (e.g. viewing the source code for the page).
Thank you in advance!
The only way the PHP code could be skipped here is if the web server was misconfigured, and failed to handle a .php file by passing it to the PHP interpreter. Instead it would be output as HTML, and the code would be visible by viewing the page source.
As long as the file is handled as a PHP script and the PHP code gets parsed, it will execute correctly. There's no means of circumventing exit().
159
No, the page will show only "Forbidden!", if the PHP interpreter is enabled.
If it's not enabled for that file extension, though, the whole source will show (including the PHP source), however you can verify that easily.
20
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
