I don't really understand how cURL works. Can it read the unparsed PHP code from a PHP file? If so, what is to stop some hacker from reading the script that connects to my database and stealing the login information?
Add a comment
|
4 Answers
No—PHP code is always parsed by the server whenever any kind of request is made. So if you use cURL to download a PHP file from the web, you will get its parsed HTML output.
Comments
No, it cannot. All cURL does is access an URL just like you would access it using a browser. If you can read the PHP source with a browser, so can cURL, if not, then not.
Comments
Through HTTP, cURL should only be able to read one or the other, so it's safe to say that if you don't see php in your browser, cURL won't either.
However, if for some reason Apache has a very broken configuration, it will just echo the contents of the source file (php). There are also ways to intentionally configure Apache to return either the rendered page or the php source, but both could not be served on the same address.
So in general, the answer to your question is no.
Comments
For an HTTP request, no. However, if you have FTP access and sufficient permissions to the server on which the PHP file is stored, you can use cURL to connect via FTP and download the unexecuted PHP source code much like you would connect with any other FTP client. I don't remember offhand if it supports SFTP or FTPS, but it likely does.
1 Comment
JD Isaacks
According to Wikipedia it supports both. Of course if they had ftp access they wouldn't need curl to steal my data. Thanks for the info. :)