超越PHP PHP动态 | 经典文章 | CLASS | 相关下载 | 常见问题 | FORUM | WIKI | 在线手册
Site search:    
<get_browserhighlight_string>
Last updated: Fri, 22 Jun 2007

highlight_file

(PHP 4 , PHP 5)

highlight_file -- Syntax highlighting of a file

Description

mixed highlight_file ( string filename [, bool return])

The highlight_file() function prints out a syntax highlighted version of the code contained in filename using the colors defined in the built-in syntax highlighter for PHP.

If the second parameter return is set to TRUE then highlight_file() will return the highlighted code as a string instead of printing it out. If the second parameter is not set to TRUE then highlight_file() will return TRUE on success, FALSE on failure.

注: The return parameter became available in PHP 4.2.0. Before this time it behaved like the default, which is FALSE

注意

Care should be taken when using the show_source() and highlight_file() functions to make sure that you do not inadvertently reveal sensitive information such as passwords or any other type of information that might create a potential security risk.

注: Since PHP 4.2.1 this function is also affected by safe_mode and open_basedir.

To setup a URL that can code highlight any script that you pass to it, we will make use of the "ForceType" directive in Apache to generate a nice URL pattern, and use the function highlight_file() to show a nice looking code list.

In your httpd.conf you can add the following:

例子 1. Creating a source highlighting URL

<Location /source>
    ForceType application/x-httpd-php
</Location>

And then make a file named source and put it in your web root directory.

<html>
<head>
<title>Source Display</title>
</head>
<body bgcolor="white">
<?php
   $script
= getenv('SCRIPT_FILENAME');
   if (!
$script) {
       echo
"<br /><b>ERROR: Script Name needed</b><br />";
   } else {
       if (
ereg("(\\.php|\\.inc)$", $script)) {
           echo
"<h1>Source of: " . getenv("PATH_INFO") . "</h1>\n<hr />\n";
          
highlight_file($script);
       } else {
           echo
"<h1>ERROR: Only PHP or include script names are allowed</h1>";
       }
   }
   echo
"<hr />Processed: " . date("Y/M/d H:i:s", time());
?>
</BODY>
</HTML>

Then you can use a URL like the one below to display a colorized version of a script located in "/path/to/script.php" in your web site.

http://www.example.com/source/path/to/script.php

See also highlight_string().




add a note add a note User Contributed Notes
highlight_file
niciaspac at yahoo dot com
14-Oct-2000 06:11
Although the example script above does do a decent job of checking the filetype (it allows only .php or .inc files to be viewed), it has some serious security issues. It allows anyone to view PHP files in password protected or IP restricted directories. If you wish to maintain any form of security, try making a source directory with symbolic links to the files you wish to share (give the links a .phps extension so the web server will serve them as highlighted text instead of parsing them.) ... Or maybe use PHP's CURL library to make the user authenticate before viewing restricted source. IP restricted directories will still be vulnerable though, assuming you have any.

<get_browserhighlight_string>
 Last updated: Fri, 22 Jun 2007
view source | feedback | send page | sitemap | aboutus   
Copyright ® 2002-2003 PHPE.NET. All rights reserved
Last updated:2002-11-22