How could I display the source file.php in HTML?

Question

I have the following PHP script (file.php) which shows the current time and displays the user's input:

Current time:

<?php

$time=time();
$actual_time=date('H:i:s',$time);
echo $actual_time;

//show user input
$enter=@$_POST['enter'];
echo '<br>Input: '.$enter;

?>

<form action="" method="POST">
    <input type="text" name="enter">
    <input type="submit" value="Refresh">
</form>

By default the page shows this:

If I enter e.g. <strong>test</strong>, I see this:

And if I enter <iframe src="file.php"></iframe>, I can reload the page in a smaller window:

So, now, how could I display the raw PHP script (file.php) by submitting some certain HTML code in the INPUT text field?

You won't see anything...... unless you bother to echo it, and recognise that file.php should be a string containing the file name: <?php echo highlight_file('file.php'); ?>.... this is where actually reading the documentation helps you — Mark Baker
– Mark Baker, Commented Dec 8, 2015 at 14:27
What do you try to achieve? If you want to attack the site - no you can not achieve this (with this sources) - at most it will be XSS. If you try to show sources for a legimate reason - you have to change a code and use for example <?php echo highlight_file('file.php'); ?> — Gennadiy Litvinyuk
– Gennadiy Litvinyuk, Commented Dec 11, 2015 at 7:49
@Andy It is a very simple difinition of insecurity. Some sites have public source code - and are secure. Many sites use Open Source software - for example - Wordpress, Wikipedia, or Stackoverflow and are nevertheless secure. Your source code has XSS - one of Top 10 vulnerabilities on the web. It does not allow to reveal your source code, but some other stuff. More information at OWASP Cross-site Scripting — Gennadiy Litvinyuk
– Gennadiy Litvinyuk, Commented Dec 11, 2015 at 10:28

Daniele Orlando · Accepted Answer · 2015-12-13 04:40:52Z

10

+50

<?php

// Disable a WebKit security feature
// which would prevent from showing the source code.
header('X-XSS-Protection: 0');

if (isset($_GET['source']) || isset($_POST['source'])) {
        $source = file_get_contents(__FILE__);

        // To prevent this control from showing up
        // in the output source code
        // enable the code below.
        /*
        $lines_to_remove = 26;
        $source = explode("\n", $source, $lines_to_remove);
        $source = $source[$lines_to_remove - 1];
        */

        $source = highlight_string($source, true);
        echo $source;

        return;
}

?>
Current time:

<?php


$time=time();
$actual_time=date('H:i:s',$time);
echo $actual_time;

//show user input
$enter=@$_POST['enter'];
echo '<br>Input: '.$enter;

?>

<form action="" method="POST">
    <input type="text" name="enter">
    <input type="submit" value="Refresh">
</form>

answered Dec 13, 2015 at 4:40

Daniele Orlando

2,7863 gold badges28 silver badges26 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Andy Over a year ago

thx! for completeness: the input has to be <iframe src="file.php?source"></iframe>

Vineet1982 · Accepted Answer · 2015-12-11 06:56:30Z

3

First

htmlspecialchars — Convert special characters to HTML entities

$new = htmlspecialchars("<a href='test'>Test</a>", ENT_QUOTES);
echo $new;

//This would be the output
&lt;a href=&#039;test&#039;&gt;Test&lt;/a&gt;

//browser will display
<a href='test'>Test</a>

Second

htmlentities -Convert all applicable characters to HTML entities

$str = "A 'quote' is <b>bold</b>";

echo htmlentities($str);

// Outputs: A 'quote' is &lt;b&gt;bold&lt;/b&gt;

echo htmlentities($str, ENT_QUOTES);
// Outputs: A &#039;quote&#039; is &lt;b&gt;bold&lt;/b&gt;

In browser it woulbe displayed:

A 'quote' is <b>bold</b>

answered Dec 11, 2015 at 6:56

Vineet1982

7,9285 gold badges34 silver badges70 bronze badges

Comments

Krii · Accepted Answer · 2015-12-08 14:27:20Z

2

Parsing the input as plain text should display the file:

<?php

$time=time();
$actual_time=date('H:i:s',$time);
echo $actual_time;

//show user input
$enter=@$_POST['enter'];

header("Content-Type: text/plain");

echo '<br>Input: '.$enter;

?>

Of course you would then have to customize your script to detect when the user wants to display the file, and only then change the content type (or else the other html inputs will not work).

answered Dec 8, 2015 at 14:27

Krii

9079 silver badges23 bronze badges

4 Comments

Andy Over a year ago

Well, it works.. but I was actually hoping to display the file without modifying it.

Krii Over a year ago

Modifying which file? You are talking about file.php? Because unless the script is file.php, you will not be modifying it.

Andy Over a year ago

yes, I mean the file file.php. What I am intending to do, is to give an input and then return the file on the screen.

Herbert Van-Vliet Over a year ago

@Andy wants to use an exploit to see the file, I suppose?

Santy · Accepted Answer · 2015-12-14 19:02:14Z

2

Submitting html or php code to then display:

<?php

$time=time();
$actual_time=date('H:i:s',$time);
echo $actual_time;

//show user input
$enter=@$_POST['enter'];
echo '<br>Input: <pre>'.htmlspecialchars($enter).'</pre>';

?>

<form action="test.php" method="POST">
    <input type="text" name="enter">
    <input type="submit" value="Refresh">
</form>

Opening a file and then display:

<?php
    $myfile = fopen("test.php", "r") or die("Unable to open file!");
    echo '<pre>'.htmlspecialchars(fread($myfile,filesize("test.php"))).'</pre>';
    fclose($myfile);
?>

answered Dec 14, 2015 at 19:02

Santy

3872 silver badges7 bronze badges

Comments

Monty Khanna · Accepted Answer · 2015-12-16 09:05:54Z

File name : test1.php

Write below code in this file :

<?php
$time=time();
$actual_time=date('H:i:s',$time): ;
echo $actual_time;

$enter=@$_POST['enter'];
if (isset($enter)) {
    $doc = new DOMDocument();
    @$doc->loadHTML($enter);
    $tags = $doc->getElementsByTagName('iframe');
    foreach ($tags as $tag) {
           $file_name = $tag->getAttribute('src');
    }
    if(isset($file_name)){
        $result ='<iframe src='.$file_name.'></iframe>';        
    }else{
        $result = $enter;   
    }
}
echo '<br>Input: '.$result;
?>
<form action="" method="POST">
    <input type="text" name="enter">
    <input type="submit" value="Refresh">
</form>

Create a new file : test6.php

Write code below in this file :

<?php
    $myfile = fopen("test1.php", "r") or die("Unable to open file!");
    echo '<pre>'.htmlspecialchars(fread($myfile,filesize("test1.php"))).'</pre>';
    fclose($myfile);
?>

Hit file : test1.php

write in input tag : <iframe src="test6.php"></iframe>

It will work !!

Huzaib Shafi · Accepted Answer · 2015-12-17 15:37:41Z

0

I don't completely understand what you are trying to achieve, however, I assume the highlight_file() function should help.

echo highlight_file('file.php',true);

answered Dec 17, 2015 at 15:37

Huzaib Shafi

1,13810 silver badges24 bronze badges

Collectives™ on Stack Overflow

How could I display the source file.php in HTML?

6 Answers 6

1 Comment

First

Second

Comments

4 Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

6 Answers 6

1 Comment

First

Second

Comments

4 Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related