PHP Show Source Code Instead of .html File

Question

I'm sorry if the title is a bit confusing, but this is my problem:
I need to echo the source of a .html file using PHP. I tried using PHP include(); while the file's extensions were .html.txt, but that showed up as if it is . When I access the file directly, for example "example.com/file.html.txt", it shows up as a normal .txt.
This is the PHP code I'm using to display the file:

<div>
<?php
include "../head.php";
$path = $_GET["p"];
?>
<div style="position:absolute; top:90px; padding-left:5px; padding-right:10px;">

<?php
echo "<code>";
include("files/".$path);
echo "</code>";
?>

</div>

I hope I'm understandable! :) Thanks in advance for your help!

I smell a gaping security hole in your code. ?p=../../../some/uploaded/file/containing/malicious/php/code — ThiefMaster
– ThiefMaster, Commented May 21, 2012 at 23:23
if the content of the file you are displaying needs to be processed by php first, use my method, otherwise, use one of the file get contents methods or love's method. and whaetver you do, do not put this code on the internet as it is a severe security hole. — dqhendricks
– dqhendricks, Commented May 21, 2012 at 23:31

svens · Accepted Answer · 2012-05-21 23:31:42Z

6

Don't use include(), read the contents of the file and print them instead (don't forget to escape).

In your case $path is user input, you should make sure that no sensitive informatin can be accessed. Using basename($path); makes sure that no directory traversal is possible.

<code>
<?php
    // $path = basename($path);
    $html = file_get_contents("files/".$path);
    echo htmlspecialchars($html);
?>
</code>

edited May 21, 2012 at 23:31

answered May 21, 2012 at 23:25

svens

11.6k6 gold badges41 silver badges55 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Mārtiņš Briedis · Accepted Answer · 2012-05-21 23:22:36Z

4

If you want to output HTML tags in an html file, use htmlspecialchars() to escape special characters.

answered May 21, 2012 at 23:22

Mārtiņš Briedis

17.9k5 gold badges59 silver badges78 bronze badges

Comments

Mafia · Accepted Answer · 2012-05-21 23:37:19Z

4

I'd suggest wrapping it inside a textarea. Simple and quick.

echo "<textarea>";
include "/filename.txt";
echo "</textarea>";

Sometimes, when we're looking for something very simple, we overlook the obvious. :o)

edited May 21, 2012 at 23:37

answered May 21, 2012 at 23:32

Mafia

8122 gold badges20 silver badges40 bronze badges

Comments

dqhendricks · Accepted Answer · 2012-05-21 23:25:34Z

2

if you want to be able to see html source in a browser, the best method would be to run it through the function htmlentities() or like. the tricky part is getting the file contents of the include into a string so that you can do that. for this we use ob_start() and ob_get_clean(). these basically start an output buffer, then get the contents of the output buffer so you can process it and echo it.

<div>
<?php
include "../head.php";
$path = $_GET["p"];
?>
<div style="position:absolute; top:90px; padding-left:5px; padding-right:10px;">

<?php
echo "<code>";
ob_start();
include("files/".$path);
echo htmlentities(ob_get_clean());
echo "</code>";
?>

</div>

answered May 21, 2012 at 23:25

dqhendricks

19.2k11 gold badges54 silver badges88 bronze badges

1 Comment

dqhendricks Over a year ago

@ColeJohnson yes, agreed. that would be more efficient haha. however if the include file is .php, this may be necessary to get the content processed, although this would also be rather dangerous security wise.

Tom · Accepted Answer · 2012-05-21 23:26:48Z

1

Include is not safe. If your file has PHP code it will be executed. You should rather use this:

echo htmlspecialchars(file_get_contents('yourfile.html'));

answered May 21, 2012 at 23:26

Tom

3,0723 gold badges47 silver badges74 bronze badges

Collectives™ on Stack Overflow

PHP Show Source Code Instead of .html File

5 Answers 5

Comments

Comments

Comments

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

Comments

Comments

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related