How can I hidding PHP

PHP programming forum. Ask questions or help people concerning PHP code. Don't understand a function? Need help implementing a class? Don't understand a class? Here is where to ask. Remember to do your homework!

Moderator: General Moderators

Post Reply
jwang
Forum Newbie
Posts: 8
Joined: Thu Oct 23, 2003 2:47 am

How can I hidding PHP

Post by jwang »

In the PHP manual have to deal with hidding PHP, it following:

Hiding PHP
In general, security by obscurity is one of the weakest forms of security. But in some cases, every little bit of extra security is desirable.

A few simple techniques can help to hide PHP, possibly slowing down an attacker who is attempting to discover weaknesses in your system. By setting expose_php = off in your php.ini file, you reduce the amount of information available to them.

Another tactic is to configure web servers such as apache to parse different filetypes through PHP, either with an .htaccess directive, or in the apache configuration file itself. You can then use misleading file extensions: Example 5-18. Hiding PHP as another language

# Make PHP code look like other code types
AddType application/x-httpd-php .asp .py .pl


Or obscure it completely: Example 5-19. Using unknown types for PHP extensions

# Make PHP code look like unknown types
AddType application/x-httpd-php .bop .foo .133t


Or hide it as html code, which has a slight performance hit because all html will be parsed through the PHP engine: Example 5-20. Using html types for PHP extensions

# Make all PHP code look like html
AddType application/x-httpd-php .htm .html


For this to work effectively, you must rename your PHP files with the above extensions. While it is a form of security through obscurity, it's a minor preventative measure with few drawbacks.


but it doesn't run when I try to use hide PHP as html.

Anyone can help me? please! Can have any example?
Thanks a lot!
User avatar
markl999
DevNet Resident
Posts: 1972
Joined: Thu Oct 16, 2003 5:49 pm
Location: Manchester (UK)

Post by markl999 »

but it doesn't run when I try to use hide PHP as html.Anyone can help me? please! Can have any example?
I just wouldn't bother trying to hide PHP, it's pointless. But anyway...
You can have any file parsed as PHP by using
AddType application/x-httpd-php .php .htm .html .foo .whatever
as descibed above. Just edit httpd.conf, make the changes and restart apache.

If it still "doesn't run when I try to use hide PHP as html" then please describe the steps you've taken so far and the exact nature of the medical emergency...er...nature of the problem.
I.e What do you see? Any error messages? What file extension are you trying etc..etc..
jwang
Forum Newbie
Posts: 8
Joined: Thu Oct 23, 2003 2:47 am

Post by jwang »

AddType application/x-httpd-php .php .htm .html .foo .whatever
as descibed above. Just edit httpd.conf, make the changes and restart apache.
Good! :D
Thanks a lot!
User avatar
volka
DevNet Evangelist
Posts: 8391
Joined: Tue May 07, 2002 9:48 am
Location: Berlin, ger

Post by volka »

unless you set expose_php = Off in your php.ini (only possible there, it's a PHP_INI_SYSTEM value) a field within the response header shows that php was used.
Post Reply