Is there any way to stop php files being served if the php processor is offline?

Question

Which is the question my partner said I'd not need answering, so to prove my point I removed php and simulated a server problem. And hey presto, the webserver serves up the PHP source as a download.

So, the question, is there a way to stop source being served up in the event of a server glitch, bug, or temporary loss of connection to the relevant modules etc?

Answer 1

Put the PHP files outside the document root, then require them from PHP files inside the document root. They'll still get a little bit of code like this or something, but that won't give them very many details:

require(dirname(dirname(__FILE__))."/real_file.php");

Answer 2

The only way source is revealed is if you change the server configuration by error – for instance, you're using a mod_php for Apache and accidentally remove the module.

For that particular case, you can do this:

<IfModule php5_module>
   AddHandler php5-script .php
   PHPIniDir "/etc"
</IfModule>
<IfModule !php5_module>
  <FilesMatch "\.php$">
      Order allow,deny
      Deny from all
      Satisfy All
  </FilesMatch>
</IfModule>

Answer 3

I wrote a couple of simple functions to parse out a URL MVC-style (based on kissmvc.com) and this is the only php in my document root:

<?php

require '../bootstrap.php';
parse_request();

So, if something did happen, that's all anyone would see. Everything else is handled starting at bootstrap. If I wanted, I could move the parse_request() into bootstrap.php, too, but I did it this way so I could include my bootstrap and not dispatch all the web site stuff if I was only hitting a cron script (and this was before I realized about the php_sapi_name() function and constant).

That does no good if you've got an existing site with php in the docroot, or are using Wordpress, etc, but if you have the option, it will prevent this specific problem from kicking you in the boys.