3 ms·

Yes. With PHP, you generally put code in the web root. This is a terrible idea, because if your PHP parser becomes non-functional for some reason (or is acciden

Yes. With PHP, you generally put code in the web root. This is a terrible idea, because if your PHP parser becomes non-functional for some reason (or is accidentally disabled) your source code is exposed to the world. With other web frameworks it is generally encouraged to put source code and static content in different directories. With the code completely outside the web root. This is much safer: never put code (or passwords) in your web templates. It is possible to do this with PHP, but in practice almost no one does that. PHP, in my experience, has a lot of these insecure-by-default issues.

sewerhorse 16y ago
no. this was a config file with a broken <?php-tag. it'll be treated as a plain text file when included/required.
russss 16y ago
This bug is nothing to do with putting code in the web root. If you miss the opening <?php tag out in any file, regardless of whether it's in the web root, it will get printed straight out to the browser.
- brown9-2 16y ago
  This sounds like "insecure by default" to me - you have to have the opening stanza correct in order for the file contents to be treated as code. Perhaps a more secure idea would be to require an opening stanza for the reverse - for content that should simply be printed to standard out? i.e. <?out to make content that should be outputed, not <?php for content that should be interpreted.
  - russss 16y ago
    Sure - I'm not defending PHP. This is all the case for backwards compatibility. The easiest solution would be to define a new file extension/MIME type which is "PHP-by-default".
    - nikcub 16y ago
      that is a great idea. I check if any of the 'hardened php' projects do this, and they don't
- deleted 16y ago
  [deleted]
- wladimir 16y ago
  Files outside the web root are not accessible by the user via HTTP, so I don't see the issue with that? Unless you include it from somewhere in the web root, but that's the other insecure-by-default behaviour I was hinting at. With a secure-by-default web framework, it's not possible to get the code to show at all because it's not intermingled with the content.
  - russss 16y ago
    If there are no PHP files in the web root then what does your web site do? Every block of PHP code must begin with '<?php', regardless of where it's located, or whether it's included from another file. I do agree with you that this is a silly behaviour. But it's nothing to do with the web root.
deleted 16y ago
[deleted]
Tomek_ 16y ago
- Nope, in PHP you don't generally put code in the web root. - PHP and generally all the frameworks based on PHP are strongly encouraging putting code outside of the web root. Just take a look at directory structures in Zend Framework (http://framework.zend.com/manual/en/learning.quickstart.create-project.html http://framework.zend.com/manual/en/learning.quickstart.crea...) or Symfony2 (http://symfony.com/doc/2.0/book/page_creation.html#the-directory-structure http://symfony.com/doc/2.0/book/page_creation.html#the-direc...) - ...and almost everyone that uses PHP professionaly does that.

sewerhorse 16y ago

no. this was a config file with a broken <?php-tag. it'll be treated as a plain text file when included/required.

russss 16y ago

This bug is nothing to do with putting code in the web root. If you miss the opening <?php tag out in any file, regardless of whether it's in the web root, it will get printed straight out to the browser.

brown9-2 16y ago
This sounds like "insecure by default" to me - you have to have the opening stanza correct in order for the file contents to be treated as code. Perhaps a more secure idea would be to require an opening stanza for the reverse - for content that should simply be printed to standard out? i.e. <?out to make content that should be outputed, not <?php for content that should be interpreted.
- russss 16y ago
  Sure - I'm not defending PHP. This is all the case for backwards compatibility. The easiest solution would be to define a new file extension/MIME type which is "PHP-by-default".
  - nikcub 16y ago
    that is a great idea. I check if any of the 'hardened php' projects do this, and they don't
deleted 16y ago
[deleted]
wladimir 16y ago
Files outside the web root are not accessible by the user via HTTP, so I don't see the issue with that? Unless you include it from somewhere in the web root, but that's the other insecure-by-default behaviour I was hinting at. With a secure-by-default web framework, it's not possible to get the code to show at all because it's not intermingled with the content.
- russss 16y ago
  If there are no PHP files in the web root then what does your web site do? Every block of PHP code must begin with '<?php', regardless of where it's located, or whether it's included from another file. I do agree with you that this is a silly behaviour. But it's nothing to do with the web root.

deleted 16y ago

[deleted]

Tomek_ 16y ago

- Nope, in PHP you don't generally put code in the web root. - PHP and generally all the frameworks based on PHP are strongly encouraging putting code outside of the web root. Just take a look at directory structures in Zend Framework (http://framework.zend.com/manual/en/learning.quickstart.create-project.html http://framework.zend.com/manual/en/learning.quickstart.crea...) or Symfony2 (http://symfony.com/doc/2.0/book/page_creation.html#the-directory-structure http://symfony.com/doc/2.0/book/page_creation.html#the-direc...) - ...and almost everyone that uses PHP professionaly does that.