When and Where PHP Code Runs

PHP code is often found within web page source code files.

Yet, the browser never sees live PHP code. Ever.

It can be an elusive concept that the browser never sees the PHP code even when the web page source code file contains it.

Which is why this article is written.

Occasionally, I'll receive a question that appears the person is trying to solve a coding issue with PHP after the web page has loaded.

So, the first thing to convey is that the browser doesn't know how to run PHP. In fact, when the browser receives the web page from the server, there is no live PHP code that can be run.

What happens is this:

1. A browser requests a web page from the server.

2. The server scans the web page source code to see if it has any live PHP code in it.

   If yes, the server:

• Runs the PHP code.

• Removes the PHP code from the web page source code.

3. The server sends the web page to the browser.

You can prove this by uploading a temporary PHP web page that contains these several lines:

<p>
The timestamp is: 
<?php
$timestamp = date('r');
echo($timestamp);
?>
</p>

Name it timestamp.php (or other *.php file name). Upload it to your server. Make a note of the timestamp.php web page's URL.

Type the URL into your browser's address bar to load the page. You will see something like the following.

The timestamp is: Sun, 22 Dec 2024 02:43:49 -0800

Through the browser's menu items, view the source code that the browser is using. You'll see the HTML p tag, the "The timestamp is:" text, and the timestamp that the PHP published by echo-ing it to the browser.

But you'll see no live PHP code.

Want additional proof?

Create another PHP web page. Call this one proof.php. The proof.php page contains this one line:

<?php file_put_contents( 'temp.txt', file_get_contents('YOURURL') ); ?>

Replace YOURURL with the timestamp.php web page URL. (It must be the full https://… URL.)

Upload proof.php to your server and type the proof.php URL into your browser.

This is what will happen:

1. The PHP file_get_contents() function will act as a browser and request the timestamp.php web page from the server.

2. The server runs the live PHP code within timestamp.php and also removes the PHP code from the timestamp.php file.

   When updating is complete, the server returns the modified timestamp.php file.

3. The file_put_contents() function opens file temp.txt and stores what the file_get_contents() function received from the server. (If you wish to change the file name or location of temp.txt in the above proof.php source code, update temp.txt to your preference.)

When you open the temp.txt file, you will see exactly what the server sent when the page was requested. There will be no live PHP code within it. But it will have the HTML p tag, the "The timestamp is:" text, and the timestamp the PHP published.

Perhaps, at this point, the concept is no longer elusive that PHP can be within web page source code files, yet never reach the browser. Instead, the PHP is run on the server and removed from the source code before the pages is sent to the browser.

Live PHP code runs only on the server.

(This article first appeared with an issue of the Possibilities newsletter.)

Will Bontrager