DEV Community

Discussion on: It's the most insecure code in the world

Collapse
 
jhilgeman profile image
Jonathan H • Edited

But what would happen if the service was
down and we had visitors to the website?

Answer: They would all get an error page.

You'd only get the PHP source if the web server was running AND was not configured to handle .php files in any specific way or the .php handler didn't actually process the script.

So this situation isn't really that common except for when you're initially configuring the web server and haven't set up PHP yet, but in those cases, you wouldn't typically have a lot of PHP code with sensitive data just sitting in the document root on a public server. If you do, the first person deserving any blame is the server admin.

The far more likely scenario is a script that takes a filename from user input and reads that file's contents into the output. That kind of thing happens all the time with novice developers

Collapse
 
andersbjorkland profile image
Anders Björkland

Thank you for this counter-point, Jonathan. It's indeed not a common occurence, and we should hardly be storing sensitive data like this. Let Olaf be a secret for now!