0

I currently have some code in my HTML page such as:

<a href="examplecode/sample.php">Click here to view this PHP code sample.</p>

The problem is that my web page is also written in PHP, so when the file is clicked the PHP code runs, which is not what I want: I want the code to be simply displayed in the web browser, and I want it to be possible to download the file. How should I proceed? I would prefer a solution where I do not have to change the .php file extension. Thanks.

NOTE: I've tried the solution outlined here. I've included the following line:

php_flag engine off

in my .htaccess file. However, if I place the .htaccess file in the examplecode directory, the PHP code runs, and if I place it in the directory above where index.php is found, then none of the PHP files in that root directory run. How can I solve this issue?

Community
  • 1
  • 1
John Sonderson
  • 3,238
  • 6
  • 31
  • 45
  • 2
    possible duplicate of [Disable PHP in directory (including all sub-directories) with .htaccess](http://stackoverflow.com/questions/1271899/disable-php-in-directory-including-all-sub-directories-with-htaccess) – Machavity Sep 10 '15 at 14:13
  • 1
    I believe that so long as you don't have the tags, the code will just print out as text even without modifying .htaccess and without changing file extension. That's how it works on my Apache2 server, anyhow. – sunny Sep 10 '15 at 14:18
  • Yes, that's true, but I need to keep the because I want the file to be a working file. I've tried the solution in the related post, but my PHP file still runs, and I don't want it to. I won't be able to change the server configuration once I upload my page, so I need a solution based on an .htaccess file in the directory where the source code is located. Can you please make a suggestion? – John Sonderson Sep 10 '15 at 16:46

1 Answers1

1

You could write another script called, for instance, show.php that can be called like examplecode/show.php?script=sample.php which contains something like the following:

<?php

$file = $_GET['file'];
if (file_exists('/path/to/webapp/examplecode/' . $file) && 'show.php' !== $file && strlen($file) - strlen('.php') == strrpos($file, '.php')) {
    echo '<code>' . file_get_contents('/path/to/webapp/examplecode/' . $file) . '</code>';
    exit;
}

echo 'Script not found: ' . $file;

Such a script might be usefule for your purpose if you want to execute the file at some point anyway without using things like eval().

Be careful, though, as you need good validation of the filename entered and you should not include any sensitive data, like database passwords etc. in those files!

thormeier
  • 672
  • 9
  • 25
  • Sure, but this solution embeds the code in the page. I want the code to open up in a separate window all of its own. Is this possible? – John Sonderson Sep 10 '15 at 16:48
  • If you want the plain file to open in a new browser window, without including/embedding/whatever, you would have to adjust your .htaccess file, see comment of @Machavity on your question for this kind of behaviour :) – thormeier Sep 10 '15 at 16:51
  • Please see my updated post. No matter where I place the php_flag directive, things are not running. – John Sonderson Sep 10 '15 at 18:04