Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

This is more of a security question: Are there any circumstances (i.e. running PHP as a CGI binary versus Apache module, examples of poor default configurations, etc.) where Apache would render the unprocessed source code for a PHP script if PHP were to crash independently of Apache?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

No: Apache delegates script processing entirely to PHP using some method or another (DSO, CGI, suPHP, whatever). Whatever it outputs, will be treated as the response to render to the user.

If it is going to crash, then most of the time, the process will crash without outputting headers. If it does not output headers (which Apache will know because it won't find a single blank line in the response), it'll render a 500 Internal Server Error failed and log a message in your error_log with Premature end of script headers.

If, say, it managed to output:

Content-type: text/plain

Segmentation Fault

Then the user will see "Segmentation Fault" on their screen, nothing more, nothing less.


Your question also says:

examples of poor default configurations

Yes, if Apache is not configured to process PHP pages, then it will output just dump the file to the user. Other than that, there is no kind of poor configuration that would get you in a half-state where it works most of the time but not all of the time.

share|improve this answer
1  
There was a report a few years ago where a Facebook server showed PHP script source. However, the webserver software had not been installed properly, and so the code was not being run by the PHP runtime, hence it was downloaded as plain text. Not a failure of PHP though. –  Alister Bulman Nov 23 '12 at 23:41
1  
Very interesting; here is a reference to that if anyone is interested: techcrunch.com/2007/08/11/facebook-source-code-leaked –  Andrew Odri Nov 24 '12 at 6:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.