Home/ Questions/Q 6680227
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-26T04:27:00+00:00

Just casual paranoia. Let’s say we have an index.php: <?php exit(‘Forbidden!’); ?> <!DOCTYPE html

  • 0

Just casual paranoia. Let’s say we have an index.php:

<?php
  exit('Forbidden!');
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"> 
<html>
  <title>Can you see me?</title>
  <script language="javascript" type="text/javascript">
    alert("Welcome!");
  </script>
  <p>You got me.</p>
</html>

Can an external user somehow reach the “Welcome!” message? And why yes/not?

Any means are valid (e.g. viewing the source code for the page).

Thank you in advance!

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The only way the PHP code could be skipped here is if the web server was misconfigured, and failed to handle a .php file by passing it to the PHP interpreter. Instead it would be output as HTML, and the code would be visible by viewing the page source.

    As long as the file is handled as a PHP script and the PHP code gets parsed, it will execute correctly. There’s no means of circumventing exit().

    • 0