I have a Shared Hosting package with HostGator. In it, I'm hosting around 4 websites. They are just some simple sites that doesn't likely to attract more visitors. But a few days ago, when I accessed one of my sites(via a browser), it outputted the PHP code of index.php, instead of outputting it as HTML.

I think, at that time, the server was a bit busy or something. I heard that, Facebook also have got a similar condition where the home page's code was made available.

So, how do I take preventive measures for this ?

I always use phpBB forum's style of coding. That is, each sub pages, common functions, etc. are separated into subfolders. And in PHP, I would just include_once() or require_once() it. Also, these subfolders have a .htaccess file in which I have set the deny permission to the files inside it from outside.

Also, in the main page(index), I would define a constant. And the first line of the subpages(which is situated in separate folders) is to check whether this constant is set. If not, calls die().

I am looking forward for solutions to this problem of outputting raw code when the page is accessed.

Thanks in advance :)

1 Answer 1


Is this a consistent problem or a 'here and there' type issue? Also, is the code being executed?

If it is a consistent problem, then you might want to check up on your host's PHP settings. PHP is exclusively a Server-Side language, meaning that what you request a page through your browser, and if the file is a .php (And PHP is installed on the server), the server will execute the code before sending the file to the client computer.

If the PHP code is being displayed in the source on the client machine, there is most definitely a problem with the server - not the code. The server shouldn't be sending the code to the client in any case, and I haven't heard of Facebook having that problem with their homepage.

Email HostGator's customer support and see if there has been any other issues with this reported with their system.

  • Thanks. During that time, server was busy I think. Because when I tried to login to cPanel, it was taking more time. And the Facebook thing, I read that from a local magazine in here several months ago(I think this is it: techcrunch.com/2007/08/11/facebook-source-code-leaked). This problem was caused only once. I haven't experienced it so far. Commented Apr 14, 2012 at 10:22
  • 2
    @Akhilesh: The statement made by Facebook about a "known issue" with PHP/Apache sending unprocessed code to browsers when under high load is a complete fabrication. If that were really a known issue developers would be abandoning PHP in droves as that's a fatal security flaw. As Chris Shiflett alluded to, such occurrences are pretty much universally due to server misconfiguration. Either short tags were used while they were disabled in PHP or the PHP handler was misconfigured in Apache. Commented Apr 14, 2012 at 12:03
  • Thanks. Yeah, you are right. My server is in India, hosted by HostGator India. I don't use short tags either. Commented Apr 14, 2012 at 12:58
  • 2
    If you have important security features that are protecting personal information, you might want to question HostGator India to find out exactly what the problem was. Simply because it hasn't happened since doesn't necessarily mean that the problem is permanently solved. Also, thanks @Lèsemajesté for the info. Commented Apr 15, 2012 at 7:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.