1

I am looking for a way to let the apache server know that my .txt contains php executable code and that it should be executed. I want that to trick browsers and users into thinking that the file is a .txt while in fact it is a php file.

example:

http://example.com/test.txt

test.txt

<?php echo "Hello World"; ?>
NinjaStars
  • 253
  • 3
  • 15
  • 1
    possible duplicate of [Is it possible to execute PHP with extension file.php.jpg?](http://stackoverflow.com/questions/8025236/is-it-possible-to-execute-php-with-extension-file-php-jpg) – Phil Jan 31 '14 at 04:01
  • 1
    Also see [Hiding PHP](http://php.net/manual/security.hiding.php) from the manual – Phil Jan 31 '14 at 04:02

2 Answers2

5

To run this on a specific file only, the following AddType would work:

<Files test.txt> 
    AddType application/x-httpd-php .txt
</Files>

For a file without an extension:

<Files test> 
    ForceType application/x-httpd-php
</Files>

If this gives you issues, you may need to use application/x-httpd-php5 (notice the "5") depending on your environment setup.

Simply place in your server/virtual host config, or within a .htaccess file.

Michael Pasqualone
  • 2,027
  • 2
  • 15
  • 23
  • what if it would be of no extension? – NinjaStars Jan 31 '14 at 04:13
  • @user2789433 In that situation (but why?) you'll need to [ForceType](http://httpd.apache.org/docs/2.2/mod/core.html#forcetype) the file. I've updated my answer. – Michael Pasqualone Jan 31 '14 at 04:16
  • Is forcetype unsafe or problematic? – NinjaStars Jan 31 '14 at 04:19
  • 1
    @user2789433 No, it's fine. The only security issue would be if you change the relevant apache config, .htaccess is deleted, then the file will be served to the user as a plain-text file. Thus exposing your PHP code. But this is no different to the risk you'd face if apache was to stop serving php altogether (client will download the raw PHP files). – Michael Pasqualone Jan 31 '14 at 04:23
2

If you want to run other file extensions as PHP, Edit your .htaccess to specify the file type. For example, to run .txt as PHP:

AddType application/x-httpd-php .txt
Jenson M John
  • 5,499
  • 5
  • 30
  • 46