blocks|key|1432187|text|不是的。除非你是在你实际使用它的地方向他们呼应。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1432188|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

No. Unless you're echoing it to them under where you're actually using it.

blocks|key|1432215|text|如果你把你的yes服务器设置为服务而不是解析你的php，是的。但这样客户就不能工作了。所以排除任何安全漏洞，答案是否定的。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1432216|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

If you have your webserver set to serve instead of parse your php yes. But then the clients wouldn't work. So the barring any security holes, answer is no.

blocks|key|1432299|text|不，但你应该采取一切措施来防止它。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1432300|你应该总是设置你的敏感代码(见鬼，为什么不是全部呢？)在你的服务器工作目录(比如/www)下面的一个目录中，如果服务器搞乱了，它将无法向世界展示你的代码，因为这些代码将包含在php中，而这些代码本来就不能工作。|1432301|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

No, but you should take all measures to prevent it.

You should always set your sensitive code (heck, why not all?) in a directory bellow your server working dir (say /www), that way if the server gets messed up, it wont be able to show your code to the world because that code will be included by php that is not working in the first place.

blocks|key|1432356|text|使用包括来自www服务目录下或外部的内容。(还不能%2B1+..对于Frankie)|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1432357|不要在http目录中使用符号链接。我以前有意使用它来根据用户请求路径显示源代码和执行，但所需httpd.conf会发生变化(或配置错误)，可以在httpd.conf中显式禁用。|1432358|如果允许使用fopen下载文件，不要将用户创建的任何内容传递给它，否则他们可能会弄清楚如何让它抓取他们能找到的任何文件。考虑一下：|1432359|fopen('reports/'+.+$_GET['blah']);|code-block|syntax|javascript|1432360|其中用户传入'../index.php‘|1432361|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|P|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|Q|8|@]|9|@]|A|$]]|$1|F|3|G|5|H|7|R|8|@]|9|@]|A|$I|J]]|$1|K|3|L|5|6|7|S|8|@]|9|@]|A|$]]|$1|M|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|N|$]]

Use includes from below or outside the www served directory. (can't +1 yet.. for Frankie)

Don't use symlinks for your http directories. I've intentionally used this to both show source and execute depending on user request path before, but that required httpd.conf changes (or misconfiguration) and can explicitly be disabled in httpd.conf.

If allowing downloads of files using fopen, don't pass anything the user creates to it or they could figure out how to get it to grab any file they can find.
Consider:

<pre><code>fopen('reports/' . $_GET['blah']);
</code></pre>

where the user passes in '../index.php'

blocks|key|1217547|text|不是的。假设您已经正确安装了L/U+UAMP服务器，或者没有打印输出(echo、print_r等)。在代码的核心部分，PHP将被处理，它要输出的逻辑或HTML将在页面上使用，不可见。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1217548|注意:如果目录中没有“索引”或正确的.htacess文件，Apache服务器将显示目录中的文件列表，您可以下载和查看这些文件。|1217549|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

No. Assuming you've installed a L/UAMP server properly, or aren't printing out (echo, print_r, etc.) and of the guts of your code, the PHP will be processed and the logic or HTML it's meant to output will be used on the page, not visible.

N.B. If there isn't an 'index' in a directory or a proper .htacess file, an Apache server will show a list of files in the directory, which can be downloaded and reviewed.

blocks|key|1217603|text|发生这种情况的一个错误是在php字符串中粘贴一个php标签，例如：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1217604|$string+=+"This+is+the+answer:+<s><?php+echo+$answer;+?></s>";+
echo+$string;|code-block|syntax|javascript|1217605|这个人做了一些应该沿着字符串打印的东西的Ctrl%2BC和Ctrl%2BV，但是编码器因为分心忘了去掉php标签。|1217606|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

One mistake for it to happen is to paste a php tag inside a php string, example:

<pre><code>$string = "This is the answer: &lt;s&gt;&lt;?php echo $answer; ?&gt;&lt;/s&gt;"; 
echo $string;
</code></pre>

The person did a Ctrl+C and Ctrl+V of something that should be printed along the string, but the coder forgot to remove the php tags by distraction.

I'm developing a PHP application that has to respond to request from several clients, and I thinks "Can any of the clients see the PHP code that I'm writing?".

Can a client view server-side PHP source code?

服务器

我正在开发一个PHP应用程序，它必须响应来自多个客户端的请求，我想“任何客户端都能看到我正在编写的PHP代码吗？”

问客户端可以查看服务器端的PHP源代码吗？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问客户端可以查看服务器端的PHP源代码吗？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问客户端可以查看服务器端的PHP源代码吗？
EN