Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

in my website there are PHP files that i include in other php files... they perform different tasks like connecting to my DB and various other functions... now i know the given path of my files.. so i can give the path like

this will give the directory listing of files in that directory..

i know to avoid the directory listing i will have put in a file name index.html OR index.php by doing so instead of directory listing

but still i know the path of file.. by doing this the code is executed but you can see the source OFFCourse because it is client side..

BUT is there a way to get that PHP file with its source code when somebody knows the path... ot will be security risk wouldn't it

share|improve this question

Well, first of all, you should be able to disable the directory listing (thereby making it not necessary to pollute your directory tree with useless index.php files) by just adding the following line into a .htaccess file in your includes directory:

Options -Indexes

Now, with regards to users being able to get the php source code, as long as your webserver is set up correctly to interpret php files and not just serve them directly, you should be fine (assuming that your include files don't echo() any variables or something silly like that).

share|improve this answer

If you have AddType or SetHandler defined for PHP files, then it'll be interpreted by apache/webserver before serving to clients. So client won't see the php source, but only the html generated.

share|improve this answer

If I understand you correctly, you'd like to get the PHP source for people knowing the actual URL of the PHP file. You might use something like that, but remeber: it's no real security, so better don't include this in PHP files containing private stuff like DB user/password etc.

 if($_GET['hash'] === "jV1V-7-VhS09K-_77GtEoOd86K2-ba-W") {

This way only people knowing that "hash" (and evil people brute-forcing you) can get that source code by going to

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.