So I want the user to be able to run write "foo.phps" for a "foo.php" script in order to present the source of that file.

I only want to do this in one directory (since it's a security risk). Can I use .htaccess?

I added a .htaccess file to the directory and wrote this in it:

AddType application/x-httpd-php-source .phps

And then restarted Apache, but I can't add "s" to the file to get the source. Do I need to do something with PHP as well?


From the php docs, you need to use a SetHandler

<FilesMatch "\.phps$">
    SetHandler application/x-httpd-php-source

If you want to know if you can use a directive in a .htaccess in general, you can always consult the documentation. For Apache 2.0, see:


Description: Maps the given filename extensions onto the specified content type
Syntax:      AddType MIME-type extension [extension] ...
Context:     server config, virtual host, directory, .htaccess
Override:    FileInfo
Status:      Base
Module:      mod_mime

In particular look at the "Context:" part.

In this specific case, yes, you can. You just need to make sure you allow overrides for FileInfo on that particular directory:


<Directory /path/to/my/site>
    AllowOverride FileInfo

You also need to make sure the file EXISTS. If you have a file called test.php you can't just magically request test.phps

In order to solve that problem, you can either use mod_rewrite to force a handler. For example, this rule is in the mod_rewrite documentation as a good example of changing the handler in mod_rewrite

RewriteEngine On
RewriteRule ^(/source/.+\.php)s$ $1 [H=application/x-httpd-php-source]

or you could create a symbolic link but you will need to do that for every file manually (or script it) and for new files.

ln -s test.php test.phps

One way of solving this is you will need an additional script that simply outputs the source of the specified file. Then you can write a rewrite rule to rewrite

  • foo.phps


  • showmethesource.php?input=foo.php

One MAJOR issue with this is security. Make sure you can only output the desired files and not any file (like /etc/passwd) !!

  • Why use a potentially vulnerable script when there's built-in functionality to do it safely?
    – ONOZ
    May 27 '14 at 6:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.