views:

48

answers:

1

Some pages are showing the phpinfo() output (in HTML so not php -i) even though there is no call to phpinfo() in that page.

The pages include a number of files, but i have grep'd the whole directory from base but cannot find any instance of phpinfo() or "phpinfo" etc.

I've also looked at all "shell", "exec" and "eval" that could generate phpinfo somehow but it doesn't show anything.

How could phpinfo() be showing up on these pages?

+2  A: 

Note that php -i will output HTML when your SAPI is CGI, even when invoked from the command line.

Still, try to run the file via CLI to see if if gives the same output. Might be Apache autoprepending another file. Check your httpdconf and .htaccess file if the output is different.

If the output is the same, check your php.ini for the directives auto_prepend_file and auto_append_file to see if there is any filenames in there.

Apart from this, no idea. Maybe install XDebug and step through the code to see where it happens.

Gordon
Your answer helped quite a bit. It turned out to be a file included form the php_include_path. I found it with:php -r "echo get_include_path();" | sed "s/\:/ /g" | xargs find | xargs grep phpinfo
bucabay