Question

I have a doubt about PHP, Apache, server interpretation… I know that when a PHP file is loaded by the browser from an Apache+PHP server it is interpreted and only the HTML and plain text is showed but is there a way to download this files instead of interpreting them?
In this case it would be very unsecure because MySQL passwords would be unsafe.

Is it any security measure to prevent this or it’s impossible to download this files?

Answer 1

As long as your server is setup properly it isn’t going to happen.

A good step though is to put all of your actual passwords and whatnot in a config.php and including it. That way you can use htacces too block that file so that should your server ever start serving the raw pages that file won’t be accessible anyway.

To clarify if you create a .htaccess file and place it in the same folder as the config.php with the below information that file will not be served, even if requested directly. Simply define your config stuff (db name, user name, password, hashes, etc) in this file and include_once it at the top of each page that needs it and you will be good to go.

<files config.php>
    order allow,deny
    deny from all
</files>