I have a wiki api site:
http://en.wikipedia.org/w/api.php
when I save the api.php, I can't see any post or get method behind that.... but I try to write a simple php program.... like this
test.php:
<?php echo("testing"); ?>
when I updated to server, and save the test.php, people can see my source code. but after I downloaded the api.php, I don't see any php source code from the api.php, but I can pass parameter to the api.php, how can they do so? Thank you.
Because when you hit that Wikipedia api.php page, you get an HTML document. You're not downloading any Wikipedia source code. You're downloading the output of a PHP script running on a Wikipedia server, and that output happens to be HTML.
As for your test file, since you get the source code instead of "testing", that means your server isn't properly configured and isn't seeing a .php file as a PHP script, and is instead serving up its raw contents.
If you uploaded a file to your server that contained php, and when you view source in your browser you see that php code, that means that your server is not executing your php. It would be parsed out naturally if it was.
You cannot see the source code of a php file, because when it is accessed on the server it is first interpreted by PHP on the server-side.
When a request goes for api.php, the server (most probably Apache) using it's PHP handler, will execute the PHP code and return you the html. Therefore, you will only see the HTML, not the PHP source code.
The reason you are able to view source code of test.php could be because your server doesn't know how to execute PHP code coz it may not be having a PHP handler. Therefore, it is showing the source code.
Related
I am experimenting with using AWS. To be specific, I am following the tutorial at this link:
https://aws.amazon.com/getting-started/hands-on/build-web-app-s3-lambda-api-gateway-dynamodb/module-three/?e=gs2020&p=build-a-web-app-two
I have tried to add empty PHP tags to the start of the file and renamed the file to index.php instead of the index.HTML of the tutorial. I did a full sequence of refreshing the web app resources and deploying the app on the Amplify console. It did not work. I tried only using the HTML code on index.php and it still did not work. I put back the PHP code, added an echo statement echo "<h1>PHP Code Ran</h1>"; but renamed the file to index.html and it did render. Granted, there was an error in the text output. It also wrote the ending semi-colon and ending quotation, but it worked.
Is there any way for me to use a file named index.php as the home page of a web app using AWS amplify?
A PHP file isn't just an HTML file with a different name: you need to have a server somewhere that's running PHP which will look at the PHP code and run it.
If you're just uploading files to S3, that's not going to happen, the file is just going to be sent straight to the browser, regardless of what you call it and what you put in it.
Putting <?php echo "<h1>PHP Code Ran</h1>"; ?> into a file "worked" only in the sense that when you opened the page in the browser, you saw your browser's best attempt to interpret that as HTML. If you go to "View Source", you'll see that the file is exactly what you uploaded to S3, no PHP has run at all.
If you want to write a PHP application, you need to understand how to run PHP - most likely on an EC2 server, but it could also be in a Fargate container, or something even fancier like bref which lets you run PHP in a Lambda function.
I'm a frontend developer and I'm facing with a problem.
Whenever I'm building a website, I'm using PHP to include the template files, so I get a redundant code.
But when I want to generate this file into an HTML file I open up the PHP file in the browser to copy/paste the code to an HTML file.
How can I make this process to be way much faster, or how could I avoid to do these things manually? Maybe there is a program to do this or something?
You can use a recursive wget.
Say your webserver runs on your localhost, you can run:
wget -r -k localhost
Be careful: wgetdoes not perform a search on which pages are available, it simply looks at links (the <a> tags) and will capture these as well. As long as everything is reachable from the index page (not necessarily on the index page), it will be downloaded.
wget is a linux program, but I guess there is a Windows application with the same name/options as well... As #rkbvkleef points out, it's part of the MinGW package.
Basically your php file (which runs on server, could be local server) contains or generates your HTML code to present on browser. You can simply write HTML code out of tags in a php file and it will work. Or if you want to generate some HTML based on some conditions you are checking inside php or using some variables in php then you can use echo function. It will display whatever string you echo on your webpage.
<?php
$name = "Murtaza";
echo("<h1>Hello ".$name."</h1>");
?>
I have a PHP script called constants.php, in there I have a lot of valuable data, like my MySQL information, etc.
Is it possible to access that script outside my machine? Lets say, using the following: include http://www.fakewebsite.com/config/constants.php
Well, yes and no.
Yes: They will be able to access the output of the file constants.php (however most likely it will be blank).
No: They won't be able to access your variables. You can only access these before PHP has been parsed.
Let's read the docs:
If "URL fopen wrappers" are enabled in PHP (which they are in the
default configuration), you can specify the file to be included using
a URL (via HTTP or other supported wrapper - see Supported Protocols
and Wrappers for a list of protocols) instead of a local pathname. If
the target server interprets the target file as PHP code, variables
may be passed to the included file using a URL request string as used
with HTTP GET. This is not strictly speaking the same thing as
including the file and having it inherit the parent file's variable
scope; the script is actually being run on the remote server and the
result is then being included into the local script.
So you can actually load external files (if your admin allows you to). However, is it going to be useful in your case? Open http://www.fakewebsite.com/config/constants.php in your web browser and open the "View Source" menu. Whatever you see there, it's what your PHP script will see (most likely, a blank page).
Last but not least... Supposing that the remote server is configured to not execute *.php files or contains a PHP script that generates PHP code, why would you want to post all that valuable and sensitive data to the Internet?
If the URL is publically accessible, then yes, anyone can read it from the URL, including scripts.
However the key part here is that they will access the output of constants.php, not the file itself. They'll get exactly the same output as you would if you accessed the file from a web browser.
What they cannot do is include your actual PHP code by calling the URL. The URL is not a direct connection to the PHP file; it's a connection to the web server. The web server then processes the PHP file and provides the output. As long as the web server is processing the PHP file before sending the output, then your PHP code is safe. It can't be seen via the URL.
There may be other ways of getting at it, but not that way.
Yes, so long as you have access to the script, you can include it within your own scripts.
I have a file located on my server and I want to remotely access that file from another server and execute source code of the file from another PHP file located on the another server.
I have had a look at “File_get_contents” however this only obtains the content displayed by that PHP file, as can be seen below.
So therefore is it possible for a PHP file from an external server to read the source code of the PHP file located on my server and execute the commands on the external server?
You can use an extension other than .php for the source file, then use file_get_contents (or similar) to retrieve the contents.
Not using the php extensions will prevent PHP from parsing it as code, and just send it over as text instead.
However, that will also make the source readable to anyone who navigates to the file in a browser, as well as introducing a possible major vulnerability. You should look into why this is necessary and if it can be avoided somehow (perhaps calling the file on the other server with GET or POSTed parameters).
Is it possible to call a PHP function found in a file on another website with a different domain?
For example, I know that to call a PHP function from another file in the same domain (say function aaa() found in aaa.php) I just have to simply do this (with a few simplifying assumptions):
include_once('aaa.php');
aaa();
I have tried doing something similar, such as:
include_once('http://othersite/aaa.php');
aaa();
I cannot get this to work (the page seems to load fine, with no error messages, but the function does not execute). I have tried require(), which gives me a blank screen. I have had no success with fopen either.
If it is possible to do this, how can I do it?
The include and require (and their _once variants) take a local filesystem path as their parameter. Domains have nothing to do with it.
Yes, you can also put an URL there (if you have the fopen wrappers enabled), but then PHP will just download the file and try to execute it. In other words, for this to work, if you entered http://othersite/aaa.php in your browser, it should show the PHP source, not the results of processing it.
When passing an URL to include \ require, PHP cannot do anything more than your browser. It's at the mercy of the webserver at othersite. If it doesn't return PHP code, there is no way that PHP can get to it.
What you are currently doing is getting the remote server to execute the PHP file and then you're reading the parsed contents -- the same as a browser would. So you get (presumably) HTML, not PHP code.
If the remote code does not need to be kept private for any reason (e.g. security) you can get the remote server to serve you the PHP source code. The easiest way to do that is to rename the file as aaa.txt, so it will not be passed to the PHP interpreter.
You can only do this if the other server is set to serve the PHP files as source -- i.e., without executing them.