How could I display the source file.php in HTML?

Question

I have the following PHP script (file.php) which shows the current time and displays the user's input:

Current time:

<?php

$time=time();
$actual_time=date('H:i:s',$time);
echo $actual_time;

//show user input
$enter=@$_POST['enter'];
echo '<br>Input: '.$enter;

?>

<form action="" method="POST">
    <input type="text" name="enter">
    <input type="submit" value="Refresh">
</form>

By default the page shows this:

If I enter eg <strong>test</strong> , I see this:

And if I enter <iframe src="file.php"></iframe> , I can reload the page in a smaller window:

So, now, how could I display the raw PHP script (file.php) by submitting some certain HTML code in the INPUT text field?

Answer 1

<?php

// Disable a WebKit security feature
// which would prevent from showing the source code.
header('X-XSS-Protection: 0');

if (isset($_GET['source']) || isset($_POST['source'])) {
        $source = file_get_contents(__FILE__);

        // To prevent this control from showing up
        // in the output source code
        // enable the code below.
        /*
        $lines_to_remove = 26;
        $source = explode("\n", $source, $lines_to_remove);
        $source = $source[$lines_to_remove - 1];
        */

        $source = highlight_string($source, true);
        echo $source;

        return;
}

?>
Current time:

<?php


$time=time();
$actual_time=date('H:i:s',$time);
echo $actual_time;

//show user input
$enter=@$_POST['enter'];
echo '<br>Input: '.$enter;

?>

<form action="" method="POST">
    <input type="text" name="enter">
    <input type="submit" value="Refresh">
</form>

Answer 2

First

htmlspecialchars — Convert special characters to HTML entities

$new = htmlspecialchars("<a href='test'>Test</a>", ENT_QUOTES);
echo $new;

//This would be the output
&lt;a href=&#039;test&#039;&gt;Test&lt;/a&gt;

//browser will display
<a href='test'>Test</a>

Second

htmlentities -Convert all applicable characters to HTML entities

$str = "A 'quote' is <b>bold</b>";

echo htmlentities($str);

// Outputs: A 'quote' is &lt;b&gt;bold&lt;/b&gt;

echo htmlentities($str, ENT_QUOTES);
// Outputs: A &#039;quote&#039; is &lt;b&gt;bold&lt;/b&gt;

In browser it woulbe displayed:

A 'quote' is <b>bold</b>

Answer 3

Parsing the input as plain text should display the file:

<?php

$time=time();
$actual_time=date('H:i:s',$time);
echo $actual_time;

//show user input
$enter=@$_POST['enter'];

header("Content-Type: text/plain");

echo '<br>Input: '.$enter;

?>

Of course you would then have to customize your script to detect when the user wants to display the file, and only then change the content type (or else the other html inputs will not work).

Answer 4

Submitting html or php code to then display:

<?php

$time=time();
$actual_time=date('H:i:s',$time);
echo $actual_time;

//show user input
$enter=@$_POST['enter'];
echo '<br>Input: <pre>'.htmlspecialchars($enter).'</pre>';

?>

<form action="test.php" method="POST">
    <input type="text" name="enter">
    <input type="submit" value="Refresh">
</form>

Opening a file and then display:

<?php
    $myfile = fopen("test.php", "r") or die("Unable to open file!");
    echo '<pre>'.htmlspecialchars(fread($myfile,filesize("test.php"))).'</pre>';
    fclose($myfile);
?>

Answer 5

File name : test1.php

Write below code in this file :

<?php
$time=time();
$actual_time=date('H:i:s',$time): ;
echo $actual_time;

$enter=@$_POST['enter'];
if (isset($enter)) {
    $doc = new DOMDocument();
    @$doc->loadHTML($enter);
    $tags = $doc->getElementsByTagName('iframe');
    foreach ($tags as $tag) {
           $file_name = $tag->getAttribute('src');
    }
    if(isset($file_name)){
        $result ='<iframe src='.$file_name.'></iframe>';        
    }else{
        $result = $enter;   
    }
}
echo '<br>Input: '.$result;
?>
<form action="" method="POST">
    <input type="text" name="enter">
    <input type="submit" value="Refresh">
</form>

Create a new file : test6.php

Write code below in this file :

<?php
    $myfile = fopen("test1.php", "r") or die("Unable to open file!");
    echo '<pre>'.htmlspecialchars(fread($myfile,filesize("test1.php"))).'</pre>';
    fclose($myfile);
?>

Hit file : test1.php

write in input tag : <iframe src="test6.php"></iframe>

It will work !!

Answer 6

我不完全理解你想要实现的目标，但是，我认为highlight_file()函数应该有所帮助。

echo highlight_file('file.php',true);