Hacker News Reader

Comment by wladimir | Hacker News Reader

Yes. With PHP, you generally put code in the web root. This is a terrible idea, because if your PHP parser becomes non-functional for some reason (or is accidentally disabled) your source code is exposed to the world.

With other web frameworks it is generally encouraged to put source code and static content in different directories. With the code completely outside the web root. This is much safer: never put code (or passwords) in your web templates.

It is possible to do this with PHP, but in practice almost no one does that. PHP, in my experience, has a lot of these insecure-by-default issues.

View on HN

- Nope, in PHP you don't generally put code in the web root.

- PHP and generally all the frameworks based on PHP are strongly encouraging putting code outside of the web root. Just take a look at directory structures in Zend Framework (http://framework.zend.com/manual/en/learning.quickstart.crea...) or Symfony2 (http://symfony.com/doc/2.0/book/page_creation.html#the-direc...)

- ...and almost everyone that uses PHP professionaly does that.

This bug is nothing to do with putting code in the web root. If you miss the opening <?php tag out in any file, regardless of whether it's in the web root, it will get printed straight out to the browser.

This sounds like "insecure by default" to me - you have to have the opening stanza correct in order for the file contents to be treated as code.

Perhaps a more secure idea would be to require an opening stanza for the reverse - for content that should simply be printed to standard out? i.e. <?out to make content that should be outputed, not <?php for content that should be interpreted.

Sure - I'm not defending PHP. This is all the case for backwards compatibility.

The easiest solution would be to define a new file extension/MIME type which is "PHP-by-default".

that is a great idea. I check if any of the 'hardened php' projects do this, and they don't

Files outside the web root are not accessible by the user via HTTP, so I don't see the issue with that?

Unless you include it from somewhere in the web root, but that's the other insecure-by-default behaviour I was hinting at. With a secure-by-default web framework, it's not possible to get the code to show at all because it's not intermingled with the content.

If there are no PHP files in the web root then what does your web site do?

Every block of PHP code must begin with '<?php', regardless of where it's located, or whether it's included from another file.

I do agree with you that this is a silly behaviour. But it's nothing to do with the web root.

no. this was a config file with a broken <?php-tag. it'll be treated as a plain text file when included/required.

Reply on news.ycombinator.com