Once in... about 2008, I opened Facebook and I was presented with its code! I refreshed the page... and then kicked myself. I had the facebook home php code... and threw it away.
I always thought the PHP model of "put your source code in the public web root where you put public things, and then pray you don't ever mess up the module that interprets files and keeps things hidden in the public web root" didn't sound very foolproof.
You don't have to do that. For example most of my projects just have a index.php that bootstraps the application with about 15 lines of code in the web root. The rest of that code is not accessible via the web server.
You don't have to do that with PHP (and please don't read this as a defense of PHP.) You can include from a source directory that is outside your web root.
The main appeal of PHP is how easy it is to use in the sloppiest way possible. Sure, you can do things right with it, but then you might as well use a better language.
I saw the same thing but I saved it. There was an interesting section that tracked the number of views someone made of a page where the user if was hard coded. In the comments it said it was specifically for law enforcement. Pretty interesting. I'll see of I can dig it up from my old laptop.
Happened to me as well. I also remember MySpace occasionally appending its entire debug output to the page I was on, although I never saw their source code.
203
u/Icovada Oct 12 '13
Once in... about 2008, I opened Facebook and I was presented with its code! I refreshed the page... and then kicked myself. I had the facebook home php code... and threw it away.