PHP How To?

by **Bren2010** on Mon Mar 02, 2009 11:09 am ([msg=19044]see PHP How To?[/msg])

Does anyone know how to keep the PHP show_source function from editing php code? Like, when I tell it to show the source of a php file, instead of looking like this:

Code: Select all: <?php phpinfo(); ?>

It looks like:

Code: Select all: <code> <?php phpinfo(); ?> </code>1

After all, I'm just gonna put it in a textarea, so I don't need all of that styling code.

by **cen** on Mon Mar 02, 2009 4:03 pm ([msg=19065]see Re: PHP How To?[/msg])

This is actually a new command for me, I've never seen this one before...

A quick google search retrieved this for me:

http://www.w3schools.com/php/func_misc_show_source.asp

Code: Select all: PHP show_source() Function -------------------------------------------------------------------------------- Complete PHP Misc Reference -------------------------------------------------------------------------------- Definition and Usage The show_source() function outputs a file with the PHP syntax highlighted. The syntax is highlighted by using HTML tags. The colors used for highlighting can be set in the php.ini file or with the ini_set() function. This function returns TRUE on success, or FALSE on failure. show_source() is an alias of highlight_file(). Syntax show_source(filename,return) Parameter Description filename Required. Specifies the file to display return Optional. If this parameter is set to TRUE, this function will return the highlighted code as a string, instead of printing it out. Default is FALSE

I saved and ran a test file:

Code: Select all: <html> <body> <?php show_source("test.php"); ?> </body> </html>

Then I modified it like this and ran it:

Code: Select all: <html> <body> <?php $test=show_source("test.php", true); echo "HERE's the code: $test"; ?> </body> </html>

And it either file ran perfectly for me.

Just thought I'd verify that it does work for me though...

Yeah, they probably worked for you because the code wasn't in a textarea, it you put it in one, it will look like what I described above.

by **cen** on Mon Mar 02, 2009 4:41 pm ([msg=19068]see Re: PHP How To?[/msg])

Sorry, but I don't understand what you're say....

It sounds like you're taking the provided code (in HTML I'm assuming???) from a text box and expecting this function to convert it to it's original PHP format??? If that's the case, it won't work.

Do you know of any way I can get this to work? Even if I use a function besides show_source? Possibly header("Content Type: text/plain")...

by **cen** on Sat Mar 07, 2009 6:59 am ([msg=19478]see Re: PHP How To?[/msg])

I think the keywords you're looking for are Remote Code Execution and Injection. Locating a vulnerability for these and exploiting them, if available, are the only likely ways I can think of for accomplishing this. The only alternative I can think of is simply brute forcing into the server and looking at the files yourself.

Good Luck

by **BhaaL** on Sun Mar 08, 2009 5:14 am ([msg=19554]see Re: PHP How To?[/msg])

How about you simply print is as if it were a text file?

Code: Select all: echo '<textarea>'; echo file_get_contents('test.php'); echo '</textarea>';

From what I think your post meant, you want to print the source of the file, into a text box, not formatted like show_source does.

*gasp It works! Thankyou SOOO much Bhaal!