why does PHP parse "*.html" files in one subdir/ but not in another?

--Apple-Mail-2--928464674
Content-Type: text/plain;
charset=US-ASCII;
format=flowed;
delsp=yes
Content-Transfer-Encoding: 7bit

Hi all,

...sitting here thinking this is so easy, and I must have been over
this already in the past.. but it is eluding me just now..

I can't figure out why files with the .html extension ARE being parsed
by PHP when they are in the main doc root dir/, or in one subdirectory
down from there.. BUT NOT when in *another* new subdirectory that I
just created. Both subdirectories have the exact same perms (same
owner & group too), both have the same php.ini file in them,...
neither have an .htaccess file in them.. (if that would matter?).

Anyway I just need to get PHP tp process all .html files in this and
in any new subdirectory(ies) that I will make.
Can someone point me to what I need to pay attention to?

Thank you
-Govinda



------------
Govinda
govinda.webdnatalk@gmail.com


--Apple-Mail-2--928464674--

Re: why does PHP parse "*.html" files in one subdir/ but not in

--001636832528a3b94e046f0436c7
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

On Sat, Jul 18, 2009 at 7:01 PM, Govinda wrote:

> Hi all,
>
> ..sitting here thinking this is so easy, and I must have been over this
> already in the past.. but it is eluding me just now..
>
> I can't figure out why files with the .html extension ARE being parsed by
> PHP when they are in the main doc root dir/, or in one subdirectory down
> from there.. BUT NOT when in *another* new subdirectory that I just
> created. Both subdirectories have the exact same perms (same owner & group
> too), both have the same php.ini file in them,... neither have an .htaccess
> file in them.. (if that would matter?).
>
> Anyway I just need to get PHP tp process all .html files in this and in any
> new subdirectory(ies) that I will make.
> Can someone point me to what I need to pay attention to?
>

It sounds like your .htaccess file may be telling .html files in a
/sub/directory/ to treat .html files as .php

Just add this to your root .htaccess
AddType x-mapp-php5 .html


>
> Thank you
> -Govinda
>
>
>
> ------------
> Govinda
> govinda.webdnatalk@gmail.com
>
>


--
- Adam Shannon ( http://ashannon.us )

--001636832528a3b94e046f0436c7--

Re: why does PHP parse "*.html" files in one subdir/ but not in another?

--Apple-Mail-3--925245262
Content-Type: text/plain;
charset=US-ASCII;
format=flowed;
delsp=yes
Content-Transfer-Encoding: 7bit


On Jul 18, 2009, at 6:36 PM, Adam Shannon wrote:

>
>
> On Sat, Jul 18, 2009 at 7:01 PM, Govinda
> wrote:
> Hi all,
>
> ..sitting here thinking this is so easy, and I must have been over
> this already in the past.. but it is eluding me just now..
>
> I can't figure out why files with the .html extension ARE being
> parsed by PHP when they are in the main doc root dir/, or in one
> subdirectory down from there.. BUT NOT when in *another* new
> subdirectory that I just created. Both subdirectories have the
> exact same perms (same owner & group too), both have the same
> php.ini file in them,... neither have an .htaccess file in them..
> (if that would matter?).
>
> Anyway I just need to get PHP tp process all .html files in this and
> in any new subdirectory(ies) that I will make.
> Can someone point me to what I need to pay attention to?
>
> It sounds like your .htaccess file may be telling .html files in a /
> sub/directory/ to treat .html files as .php
>
> Just add this to your root .htaccess
> AddType x-mapp-php5 .html

Thanks Adam. But still no luck. I did add that line to the .htaccess
file in my doc root, but my file.html in subdir/ is still not being
parsed by PHP.
??

-G
--Apple-Mail-3--925245262--

Re: why does PHP parse "*.html" files in one subdir/ but not in

--00163642719ea0f546046f05081e
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

On Sat, Jul 18, 2009 at 7:54 PM, Govinda wrote:

>
> On Jul 18, 2009, at 6:36 PM, Adam Shannon wrote:
>
>
>
> On Sat, Jul 18, 2009 at 7:01 PM, Govinda wrote:
>
>> Hi all,
>>
>> ..sitting here thinking this is so easy, and I must have been over this
>> already in the past.. but it is eluding me just now..
>>
>> I can't figure out why files with the .html extension ARE being parsed by
>> PHP when they are in the main doc root dir/, or in one subdirectory down
>> from there.. BUT NOT when in *another* new subdirectory that I just
>> created. Both subdirectories have the exact same perms (same owner & group
>> too), both have the same php.ini file in them,... neither have an .htaccess
>> file in them.. (if that would matter?).
>>
>> Anyway I just need to get PHP tp process all .html files in this and in
>> any new subdirectory(ies) that I will make.
>> Can someone point me to what I need to pay attention to?
>>
>
> It sounds like your .htaccess file may be telling .html files in a
> /sub/directory/ to treat .html files as .php
>
> Just add this to your root .htaccess
> AddType x-mapp-php5 .html
>
>
> Thanks Adam. But still no luck. I did add that line to the .htaccess file
> in my doc root, but my file.html in subdir/ is still not being parsed by
> PHP.
> ??
>

Try to put that same line of .htaccess into the sub directory. Your host
may not allow .htaccess rules to be many directories deep.


>
> -G
>



--
- Adam Shannon ( http://ashannon.us )

--00163642719ea0f546046f05081e--

Re: why does PHP parse "*.html" files in one subdir/ but not

On Sat, Jul 18, 2009 at 06:01:14PM -0600, Govinda wrote:

> Hi all,
>
> ..sitting here thinking this is so easy, and I must have been over
> this already in the past.. but it is eluding me just now..
>
> I can't figure out why files with the .html extension ARE being parsed
> by PHP when they are in the main doc root dir/, or in one subdirectory
> down from there.. BUT NOT when in *another* new subdirectory that I
> just created. Both subdirectories have the exact same perms (same
> owner & group too), both have the same php.ini file in them,...
> neither have an .htaccess file in them.. (if that would matter?).
>
> Anyway I just need to get PHP tp process all .html files in this and
> in any new subdirectory(ies) that I will make.
> Can someone point me to what I need to pay attention to?

You do realize that PHP does not parse HTML files, right? The web server
does that. In fact, the web server also parses PHP files, using a
different library.

Paul

--
Paul M. Foster

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: why does PHP parse "*.html" files in one subdir/ but not in

i never used x-mapp-php5, but most of a forums say it is specific to
1and1 hosting service. php recommends application/x-httpd-php

http://us2.php.net/manual/en/install.unix.apache2.php

try adding AddType application/x-httpd-php .html in your root htaccess
if that dosent help you'll have to add that to your htpd.conf file

> You do realize that PHP does not parse HTML files, right? The web server
> does that. In fact, the web server also parses PHP files, using a
> different library.
Kindly elaborate If you are saying that PHP cant parse files with
extension .html
http://us2.php.net/manual/en/security.hiding.php.

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: why does PHP parse "*.html" files in one subdir/ but not in another?

--Apple-Mail-5--911331560
Content-Type: text/plain;
charset=US-ASCII;
format=flowed;
delsp=yes
Content-Transfer-Encoding: 7bit

>>
>> Just add this to your root .htaccess
>> AddType x-mapp-php5 .html
>
> Thanks Adam. But still no luck. I did add that line to
> the .htaccess file in my doc root, but my file.html in subdir/ is
> still not being parsed by PHP.
> ??
>
> Try to put that same line of .htaccess into the sub directory. Your
> host may not allow .htaccess rules to be many directories deep.

I just tried this, at your recommendation, but still no luck.
--Apple-Mail-5--911331560--

Re: why does PHP parse "*.html" files in one subdir/ but not in another?

--Apple-Mail-6--911028204
Content-Type: text/plain;
charset=US-ASCII;
format=flowed;
delsp=yes
Content-Transfer-Encoding: 7bit

> You do realize that PHP does not parse HTML files, right? The web
> server
> does that. In fact, the web server also parses PHP files, using a
> different library.

I understand. I just was saying it that way. Actually I rarely think
too deeply about that specifically, but now that you pointed it out I
realize I do know that. Thanks..
-G
--Apple-Mail-6--911028204--

need to get .html files parsed by PHP. -- WAS: why does PHP parse "*.html" files in one

> i never used x-mapp-php5, but most of a forums say it is specific to
> 1and1 hosting service. php recommends application/x-httpd-php
>
> http://us2.php.net/manual/en/install.unix.apache2.php
>
> try adding AddType application/x-httpd-php .html in your root htaccess

hmmm. Darn! I just did try what you suggested above. Still no luck.

> if that dosent help you'll have to add that to your htpd.conf file

I am guessing that this means that I am outta luck since I am on a
shared hosting environment and assume I do not have access to
httpd.conf.

Agreed?

> It sounds like your .htaccess file may be telling .html files in a /
> sub/directory/ to treat .html files as .php

I'm sorry I misled everyone. I just looked better at things and .html
files are NOT getting their PHP parsed... *not anywhere*. So I
assume then that it IS an httpd.conf issue. (?) ...and only the
host admin can turn this on for me? (Because if it is something I
have control over he is going to give me a hard time ;-)

-G

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: why does PHP parse "*.html" files in one subdir/ but notin another?

Govinda wrote:
> Hi all,
>
> ..sitting here thinking this is so easy, and I must have been over this
> already in the past.. but it is eluding me just now..
>
> I can't figure out why files with the .html extension ARE being parsed
> by PHP when they are in the main doc root dir/, or in one subdirectory
> down from there.. BUT NOT when in *another* new subdirectory that I
> just created. Both subdirectories have the exact same perms (same owner
> & group too), both have the same php.ini file in them,... neither have
> an .htaccess file in them.. (if that would matter?).
>
> Anyway I just need to get PHP tp process all .html files in this and in
> any new subdirectory(ies) that I will make.
> Can someone point me to what I need to pay attention to?
>
> Thank you
> -Govinda
>
>
>
> ------------
> Govinda
> govinda.webdnatalk@gmail.com
>
>

Another thing you could do is, instead of a .htaccess, use a php.ini file in your
DOCUMENT_ROOT. Sometimes hosts allow this file. If allowed, you will then be able
to set any php.ini configuration option you want.

Give it a shot! What do you have to loose at this point?

Jim

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: why does PHP parse "*.html" files in one subdir/ but not in

2009/7/19 Jim Lucas :
> Govinda wrote:
>>
>> Hi all,
>>
>> ..sitting here thinking this is so easy, and I must have been over this
>> already in the past..  but it is eluding me just now..
>>
>> I can't figure out why files with the .html extension ARE being parsed b=
y
>> PHP when they are in the main doc root dir/, or in one subdirectory down
>> from there..  BUT NOT when in *another* new subdirectory that I jus=
t
>> created.  Both subdirectories have the exact same perms (same owner=
& group
>> too), both have the same php.ini file in them,...  neither have an =
..htaccess
>> file in them..  (if that would matter?).
>>
>> Anyway I just need to get PHP tp process all .html files in this and in
>> any new subdirectory(ies) that I will make.
>> Can someone point me to what I need to pay attention to?
>>
>> Thank you
>> -Govinda
>>
>>
>>
>> ------------
>> Govinda
>> govinda.webdnatalk@gmail.com
>>
>>
>
> Another thing you could do is, instead of a .htaccess, use a php.ini file=
in
> your
> DOCUMENT_ROOT.  Sometimes hosts allow this file.  If allowed, y=
ou will then
> be able
> to set any php.ini configuration option you want.
>
> Give it a shot!  What do you have to loose at this point?

Lose not loose, and php.ini has no control over what file types get
parsed by PHP.

-Stuart

--=20
http://stut.net/

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: need to get .html files parsed by PHP. -- WAS: why

On Sat, 2009-07-18 at 23:09 -0600, Govinda wrote:
> > i never used x-mapp-php5, but most of a forums say it is specific to
> > 1and1 hosting service. php recommends application/x-httpd-php
> >
> > http://us2.php.net/manual/en/install.unix.apache2.php
> >
> > try adding AddType application/x-httpd-php .html in your root htaccess
>
> hmmm. Darn! I just did try what you suggested above. Still no luck.
>
> > if that dosent help you'll have to add that to your htpd.conf file
>
> I am guessing that this means that I am outta luck since I am on a
> shared hosting environment and assume I do not have access to
> httpd.conf.
>
> Agreed?
>
> > It sounds like your .htaccess file may be telling .html files in a /
> > sub/directory/ to treat .html files as .php
>
> I'm sorry I misled everyone. I just looked better at things and .html
> files are NOT getting their PHP parsed... *not anywhere*. So I
> assume then that it IS an httpd.conf issue. (?) ...and only the
> host admin can turn this on for me? (Because if it is something I
> have control over he is going to give me a hard time ;-)
>
> -G
>
Generally, if a file has a .html extenstion, then it should really just
contain html. .php extensions are meant for php code containing html.

Thanks
Ash
www.ashleysheridan.co.uk


--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: need to get .html files parsed by PHP. -- WAS: why does PHP

On Sun, Jul 19, 2009 at 2:53 AM, Ashley
Sheridan wrote:
> On Sat, 2009-07-18 at 23:09 -0600, Govinda wrote:
>> > i never used x-mapp-php5, but most of a forums say it is specific to
>> > 1and1 hosting service. php recommends application/x-httpd-php
>> >
>> > http://us2.php.net/manual/en/install.unix.apache2.php
>> >
>> > try adding AddType application/x-httpd-php .html in your root htaccess
>>
>> hmmm.   Darn!   I just did try what you suggested above. =C2=
=A0Still no luck.
>>
>> > if that dosent help you'll have to add that to your htpd.conf file
>>
>> I am guessing that this means that I am outta luck since I am on a
>> shared hosting environment and assume I do not have access to
>> httpd.conf.
>>
>> Agreed?
>>
>> > It sounds like your .htaccess file may be telling .html files in a /
>> > sub/directory/ to treat .html files as .php
>>
>> I'm sorry I misled everyone.  I just looked better at things and .h=
tml
>> files are NOT getting their PHP parsed...  *not anywhere*.   S=
o I
>> assume then that it IS an httpd.conf issue.  (?)   ...and only=
the
>> host admin can turn this on for me?  (Because if it is something I
>> have control over he is going to give me a hard time ;-)
>>
>> -G
>>
> Generally, if a file has a .html extenstion, then it should really just
> contain html. .php extensions are meant for php code containing html.
>
> Thanks
> Ash
> www.ashleysheridan.co.uk
>
>
> --
> PHP General Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>

File extension has absolutely no bearing at all on the contents of the
file. There's valid reasons to not expose what's what under the hood,
especially if there happen to be known exploits in the latest version
of PHP that week. God forbid that that happens, but it does every so
often. File mime-type being determined by an extension is entirely M$
Windows mentality and doesn't really extend to *nix environments,
where most of us are hosting our sites, anyway. You could name your
scripts whatever you want, .awesome, .refridgerator, .silver, whatever
and it'd have no bearing on the files themselves. It's certainly the
de-factor standard that .html files only contain flat markup, but
that's by no means a rule or anything, but it's common practice
(mostly because programmers are lazy).

Sorry if I sound rude, just quit smoking :)
--Eddie

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: need to get .html files parsed by PHP. -- WAS: why does PHP parse "*.html" files in o

>> Generally, if a file has a .html extenstion, then it should really
>> just
>> contain html. .php extensions are meant for php code containing html.
>>
>
> File extension has absolutely no bearing at all on the contents of the
> file. There's valid reasons to not expose what's what under the hood,
> especially if there happen to be known exploits in the latest version
> of PHP that week. God forbid that that happens, but it does every so
> often. File mime-type being determined by an extension is entirely M$
> Windows mentality and doesn't really extend to *nix environments,
> where most of us are hosting our sites, anyway. You could name your
> scripts whatever you want, .awesome, .refridgerator, .silver, whatever
> and it'd have no bearing on the files themselves. It's certainly the
> de-factor standard that .html files only contain flat markup, but
> that's by no means a rule or anything, but it's common practice
> (mostly because programmers are lazy).

Yes, I wanted to hide the .php extension in case any wandering evil-
doing should find a hole in my site.. until I get really good at
preventing any possible holes. I see facebook uses the .php extension
so I assume there is ultimately nothing to fear, but I'm a php newb.

>
> Sorry if I sound rude, just quit smoking :)

Hey, nice going! Hang in there! :-)

-G


--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: need to get .html files parsed by PHP. -- WAS: why does PHP

--0016361640ad2c13dd046f10236e
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

On Sun, Jul 19, 2009 at 3:39 AM, Eddie Drapkin wrote:

> On Sun, Jul 19, 2009 at 2:53 AM, Ashley
> Sheridan wrote:
> > On Sat, 2009-07-18 at 23:09 -0600, Govinda wrote:
> >> > i never used x-mapp-php5, but most of a forums say it is specific to
> >> > 1and1 hosting service. php recommends application/x-httpd-php
> >> >
> >> > http://us2.php.net/manual/en/install.unix.apache2.php
> >> >
> >> > try adding AddType application/x-httpd-php .html in your root htaccess
> >>
> >> hmmm. Darn! I just did try what you suggested above. Still no luck.
> >>
> >> > if that dosent help you'll have to add that to your htpd.conf file
> >>
> >> I am guessing that this means that I am outta luck since I am on a
> >> shared hosting environment and assume I do not have access to
> >> httpd.conf.
> >>
> >> Agreed?
> >>
> >> > It sounds like your .htaccess file may be telling .html files in a /
> >> > sub/directory/ to treat .html files as .php
> >>
> >> I'm sorry I misled everyone. I just looked better at things and .html
> >> files are NOT getting their PHP parsed... *not anywhere*. So I
> >> assume then that it IS an httpd.conf issue. (?) ...and only the
> >> host admin can turn this on for me? (Because if it is something I
> >> have control over he is going to give me a hard time ;-)
> >>
> >> -G
> >>
> > Generally, if a file has a .html extenstion, then it should really just
> > contain html. .php extensions are meant for php code containing html.
> >
> > Thanks
> > Ash
> > www.ashleysheridan.co.uk
> >
> >
> > --
> > PHP General Mailing List (http://www.php.net/)
> > To unsubscribe, visit: http://www.php.net/unsub.php
> >
> >
>
> File extension has absolutely no bearing at all on the contents of the
> file. There's valid reasons to not expose what's what under the hood,
> especially if there happen to be known exploits in the latest version
> of PHP that week. God forbid that that happens, but it does every so
> often. File mime-type being determined by an extension is entirely M$
> Windows mentality and doesn't really extend to *nix environments,
> where most of us are hosting our sites, anyway. You could name your
> scripts whatever you want, .awesome, .refridgerator, .silver, whatever
> and it'd have no bearing on the files themselves. It's certainly the
> de-factor standard that .html files only contain flat markup, but
> that's by no means a rule or anything, but it's common practice
> (mostly because programmers are lazy).
>
> Sorry if I sound rude, just quit smoking :)
> --Eddie
>
> --
> PHP General Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>
Eddie your exactly right, changing file MIME types is often used for
security and protection. It is harder to know what is behind the "show"
when you don't visually expose it. (A simple curl will give you the HTTP
headers often with PHP as a/the agent.)

--
- Adam Shannon ( http://ashannon.us )

--0016361640ad2c13dd046f10236e--

Re: need to get .html files parsed by PHP. -- WAS: why does PHP

2009/7/19 Govinda :
>>> Generally, if a file has a .html extenstion, then it should really just
>>> contain html. .php extensions are meant for php code containing html.
>>>
>>
>> File extension has absolutely no bearing at all on the contents of the
>> file.  There's valid reasons to not expose what's what under the ho=
od,
>> especially if there happen to be known exploits in the latest version
>> of PHP that week.  God forbid that that happens, but it does every =
so
>> often.  File mime-type being determined by an extension is entirely=
M$
>> Windows mentality and doesn't really extend to *nix environments,
>> where most of us are hosting our sites, anyway.  You could name you=
r
>> scripts whatever you want, .awesome, .refridgerator, .silver, whatever
>> and it'd have no bearing on the files themselves.  It's certainly t=
he
>> de-factor standard that .html files only contain flat markup, but
>> that's by no means a rule or anything, but it's common practice
>> (mostly because programmers are lazy).
>
> Yes, I wanted to hide the .php extension in case any wandering evil-doing
> should find a hole in my site..  until I get really good at preventi=
ng any
> possible holes.  I see facebook uses the .php extension so I assume =
there is
> ultimately nothing to fear, but I'm a php newb.
>
>>
>> Sorry if I sound rude, just quit smoking :)
>
> Hey, nice going!  Hang in there!   :-)

Most security issues have nothing to do with the programming language
and everything to do with the code. Just because "facebook uses the
..php extension" certainly does not mean their code has no security
holes and even if it's clean it certainly doesn't mean your code will
be secure.

If you really want to hide the fact that you're using PHP you need to
make sure that...

* You're not using the .php extension
* You turn expose_php off in your php.ini
* You turn display_errors off in your php.ini

However, I would recommend spending time checking and testing your
code to ensure it's secure since security through obfuscation does not
make your code secure.

-Stuart

--=20
http://stut.net/

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: need to get .html files parsed by PHP. -- WAS: why does PHP parse "*.html" files in o

On Jul 19, 2009, at 10:43 AM, Govinda wrote:

>>> Generally, if a file has a .html extenstion, then it should really
>>> just
>>> contain html. .php extensions are meant for php code containing
>>> html.
>>>
>>
>> File extension has absolutely no bearing at all on the contents of
>> the
>> file. There's valid reasons to not expose what's what under the
>> hood,
>> especially if there happen to be known exploits in the latest version
>> of PHP that week. God forbid that that happens, but it does every so
>> often. File mime-type being determined by an extension is entirely
>> M$
>> Windows mentality and doesn't really extend to *nix environments,
>> where most of us are hosting our sites, anyway. You could name your
>> scripts whatever you want, .awesome, .refridgerator, .silver,
>> whatever
>> and it'd have no bearing on the files themselves. It's certainly the
>> de-factor standard that .html files only contain flat markup, but
>> that's by no means a rule or anything, but it's common practice
>> (mostly because programmers are lazy).
>
> Yes, I wanted to hide the .php extension in case any wandering evil-
> doing should find a hole in my site.. until I get really good at
> preventing any possible holes. I see facebook uses the .php
> extension so I assume there is ultimately nothing to fear, but I'm a
> php newb.
>
>>
>> Sorry if I sound rude, just quit smoking :)
>
> Hey, nice going! Hang in there! :-)

One easy way to do it is to stick the file in a folder.... So if you
have a page called: database.php create a folder called database and
then inside of that name the file index.php Helps to keep the site
organized too :)



--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: need to get .html files parsed by PHP. -- WAS: why does PHP parse "*.html" files in o

> Most security issues have nothing to do with the programming language
> and everything to do with the code. Just because "facebook uses the
> .php extension" certainly does not mean their code has no security
> holes and even if it's clean it certainly doesn't mean your code will
> be secure.

Stuart I hear you. Writing rock solid code is my aim.. I was just
trying to cover my butt a little (for whatever very little it is
worth) in the meanwhile by way of obfuscation.

>
> If you really want to hide the fact that you're using PHP you need to
> make sure that...
>
> * You're not using the .php extension

thus my OP.

> * You turn expose_php off in your php.ini

what does this one ^^^ do exactly ?

> * You turn display_errors off in your php.ini


--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: need to get .html files parsed by PHP. -- WAS: why does PHP

--00163646d8e69ab32a046f109dde
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

On Sun, Jul 19, 2009 at 10:00 AM, Govinda wrote:

> Most security issues have nothing to do with the programming language
>> and everything to do with the code. Just because "facebook uses the
>> .php extension" certainly does not mean their code has no security
>> holes and even if it's clean it certainly doesn't mean your code will
>> be secure.
>>
>
> Stuart I hear you. Writing rock solid code is my aim.. I was just trying
> to cover my butt a little (for whatever very little it is worth) in the
> meanwhile by way of obfuscation.
>
>
>> If you really want to hide the fact that you're using PHP you need to
>> make sure that...
>>
>> * You're not using the .php extension
>>
>
> thus my OP.
>
> * You turn expose_php off in your php.ini
>>
>
> what does this one ^^^ do exactly ?


It turns off the "Powered By: PHP v5.30" on Apache/IIS Error messages.


>
>
> * You turn display_errors off in your php.ini
>>
>
>
> --
> PHP General Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>


--
- Adam Shannon ( http://ashannon.us )

--00163646d8e69ab32a046f109dde--

Re: need to get .html files parsed by PHP. -- WAS: why does PHP

--001636417dc16d48e2046f114340
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

>
> On Sun, Jul 19, 2009 at 10:00 AM, Govinda > >wrote:
>
> >
> > * You turn expose_php off in your php.ini
> >>
> >
> > what does this one ^^^ do exactly ?
>
expose_php boolean

Decides whether PHP may expose the fact that it is installed on the server
(e.g. by adding its signature to the Web server header). It is no security
threat in any way, but it makes it possible to determine whether you use PHP
on your server or not.

--001636417dc16d48e2046f114340--

Re: why does PHP parse "*.html" files in one subdir/ but not

On Sun, Jul 19, 2009 at 09:30:33AM +0530, kranthi wrote:

>
> > You do realize that PHP does not parse HTML files, right? The web server
> > does that. In fact, the web server also parses PHP files, using a
> > different library.
>
> Kindly elaborate If you are saying that PHP cant parse files with
> extension .html
> http://us2.php.net/manual/en/security.hiding.php.

That's exactly what I'm saying. Apache or IIS (or whatever) discern the
contents of a file and determine how to parse it. As far as I know,
Apache, even with a PHP file, parses the HTML in the file and hands PHP
off to a PHP module to decode. The PHP engine itself does not parse the
HTML which is interspersed in and amongst your PHP code. The web server
does that. Unless some php internals person says otherwise, that's the
story. At best, the PHP engine would simply echo non-PHP text to the
browser, which is not parsing it.

Paul

--
Paul M. Foster

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: why does PHP parse "*.html" files in one subdir/ but not

On Sun, 2009-07-19 at 14:07 -0400, Paul M Foster wrote:
> On Sun, Jul 19, 2009 at 09:30:33AM +0530, kranthi wrote:
>
> >
> > > You do realize that PHP does not parse HTML files, right? The web server
> > > does that. In fact, the web server also parses PHP files, using a
> > > different library.
> >
> > Kindly elaborate If you are saying that PHP cant parse files with
> > extension .html
> > http://us2.php.net/manual/en/security.hiding.php.
>
> That's exactly what I'm saying. Apache or IIS (or whatever) discern the
> contents of a file and determine how to parse it. As far as I know,
> Apache, even with a PHP file, parses the HTML in the file and hands PHP
> off to a PHP module to decode. The PHP engine itself does not parse the
> HTML which is interspersed in and amongst your PHP code. The web server
> does that. Unless some php internals person says otherwise, that's the
> story. At best, the PHP engine would simply echo non-PHP text to the
> browser, which is not parsing it.
>
> Paul
>
> --
> Paul M. Foster
>
I thought that files that were deemed to be PHP files (indicated to the
web server by the extension and not the content) were sent to the PHP
parser, and *that* decided what bits went to the web server as regular
output.

Thanks
Ash
www.ashleysheridan.co.uk


--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: why does PHP parse "*.html" files in one subdir/ but not in

2009/7/19 Paul M Foster :
> On Sun, Jul 19, 2009 at 09:30:33AM +0530, kranthi wrote:
>
>>
>> > You do realize that PHP does not parse HTML files, right? The web server
>> > does that. In fact, the web server also parses PHP files, using a
>> > different library.
>>
>> Kindly elaborate If you are saying that PHP cant parse files with
>> extension .html
>> http://us2.php.net/manual/en/security.hiding.php.
>
> That's exactly what I'm saying. Apache or IIS (or whatever) discern the
> contents of a file and determine how to parse it. As far as I know,
> Apache, even with a PHP file, parses the HTML in the file and hands PHP
> off to a PHP module to decode. The PHP engine itself does not parse the
> HTML which is interspersed in and amongst your PHP code. The web server
> does that. Unless some php internals person says otherwise, that's the
> story. At best, the PHP engine would simply echo non-PHP text to the
> browser, which is not parsing it.

Actually that's not accurate. The web server does nothing with a file
before it passes it to the PHP engine. PHP gets the entire file, it
simply echo's anything not inside PHP tags.

In general web servers don't know or care about the format of the
files they serve. You configure certain extensions to be passed to
certain modules, even in the case of something like SSI. The web
server itself doesn't usually "parse" any of the files it serves.

-Stuart

--
http://stut.net/

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: why does PHP parse "*.html" files in one subdir/ but not

On Sun, Jul 19, 2009 at 07:18:34PM +0100, Stuart wrote:

> 2009/7/19 Paul M Foster :
> > On Sun, Jul 19, 2009 at 09:30:33AM +0530, kranthi wrote:
> >
> >>
> >> > You do realize that PHP does not parse HTML files, right? The web server
> >> > does that. In fact, the web server also parses PHP files, using a
> >> > different library.
> >>
> >> Kindly elaborate If you are saying that PHP cant parse files with
> >> extension .html
> >> http://us2.php.net/manual/en/security.hiding.php.
> >
> > That's exactly what I'm saying. Apache or IIS (or whatever) discern the
> > contents of a file and determine how to parse it. As far as I know,
> > Apache, even with a PHP file, parses the HTML in the file and hands PHP
> > off to a PHP module to decode. The PHP engine itself does not parse the
> > HTML which is interspersed in and amongst your PHP code. The web server
> > does that. Unless some php internals person says otherwise, that's the
> > story. At best, the PHP engine would simply echo non-PHP text to the
> > browser, which is not parsing it.
>
> Actually that's not accurate. The web server does nothing with a file
> before it passes it to the PHP engine. PHP gets the entire file, it
> simply echo's anything not inside PHP tags.

Then I stand corrected. But again, this means that PHP doesn't actually
*parse* the HTML it echoes.

Paul

--
Paul M. Foster

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: why does PHP parse "*.html" files in one subdir/ but not in

2009/7/19 Paul M Foster :
> On Sun, Jul 19, 2009 at 07:18:34PM +0100, Stuart wrote:
>
>> 2009/7/19 Paul M Foster :
>> > On Sun, Jul 19, 2009 at 09:30:33AM +0530, kranthi wrote:
>> >
>> >>
>> >> > You do realize that PHP does not parse HTML files, right? The web server
>> >> > does that. In fact, the web server also parses PHP files, using a
>> >> > different library.
>> >>
>> >> Kindly elaborate If you are saying that PHP cant parse files with
>> >> extension .html
>> >> http://us2.php.net/manual/en/security.hiding.php.
>> >
>> > That's exactly what I'm saying. Apache or IIS (or whatever) discern the
>> > contents of a file and determine how to parse it. As far as I know,
>> > Apache, even with a PHP file, parses the HTML in the file and hands PHP
>> > off to a PHP module to decode. The PHP engine itself does not parse the
>> > HTML which is interspersed in and amongst your PHP code. The web server
>> > does that. Unless some php internals person says otherwise, that's the
>> > story. At best, the PHP engine would simply echo non-PHP text to the
>> > browser, which is not parsing it.
>>
>> Actually that's not accurate. The web server does nothing with a file
>> before it passes it to the PHP engine. PHP gets the entire file, it
>> simply echo's anything not inside PHP tags.
>
> Then I stand corrected. But again, this means that PHP doesn't actually
> *parse* the HTML it echoes.

Technically it parses the the entire file looking for PHP tags, but
that's being overly picky.

-Stuart

--
http://stut.net/

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php