Question

I’m sorry if the title is a bit confusing, but this is my problem:
I need to echo the source of a .html file using PHP. I tried using PHP include(); while the file’s extensions were .html.txt, but that showed up as if it is . When I access the file directly, for example “example.com/file.html.txt”, it shows up as a normal .txt.

This is the PHP code I’m using to display the file:

<div>
<?php
include "../head.php";
$path = $_GET["p"];
?>
<div style="position:absolute; top:90px; padding-left:5px; padding-right:10px;">

<?php
echo "<code>";
include("files/".$path);
echo "</code>";
?>

</div>

I hope I’m understandable! 🙂 Thanks in advance for your help!

Answer 1

Don’t use include(), read the contents of the file and print them instead (don’t forget to escape).

In your case $path is user input, you should make sure that no sensitive informatin can be accessed. Using basename($path); makes sure that no directory traversal is possible.

<code>
<?php
    // $path = basename($path);
    $html = file_get_contents("files/".$path);
    echo htmlspecialchars($html);
?>
</code>