What is the PHP file format?
A .php file is a plain-text document that contains source code written in PHP (Hypertext Preprocessor), a widely-used server-side scripting language. A .php file can contain PHP code mixed with HTML markup, text, and inline CSS or JavaScript.
PHP file applications
PHP files are used to generate HTML pages dynamically using the server's PHP engine. PHP files are also used to create web applications. Websites commonly utilize .php files to process online forms - for example, a contact data form - or as a means to access databases. WordPress, a well-known content management system, uses PHP scripts extensively, as do popular frameworks such as Laravel and Symfony.
Processing PHP files
PHP file code is processed by the PHP engine residing on the web server, which generates dynamic HTML output. This HTML content is then sent to the user's web browser and displayed as a web page. This process ensures that actual PHP code cannot be accessed by the user, even by viewing the page source. PHP code blocks begin with the <?php opening tag; the closing ?> tag is intentionally omitted at the end of pure script files to prevent unintended output before HTTP headers are sent.
Additional information
Security & safety
RISK: MEDIUMA .php file is a program that runs ON A SERVER, so a malicious PHP script (a "web shell" like c99/r57) uploaded to a site can let an attacker run commands, read the database, or take over the server - never deploy .php files from untrusted sources to a live site without reviewing them. Merely opening a .php in a text editor is safe (it's only text) and does NOT execute it. Two operational risks: (1) .php files often contain database passwords and API keys, so they must not be publicly downloadable; (2) running PHP on an outdated, end-of-life version (PHP 5/7) exposes known vulnerabilities - keep PHP updated to a supported 8.x branch.
Format details
in a nutshellPrograms that open PHP files
Technical details
deep spec| File type | Plain-text server-side script, UTF-8 encoded |
| MIME type | application/x-httpd-php |
| File signature (magic bytes) | None - plain text with no binary signature; files typically open with the <?php tag at byte offset 0 |
| Opening tag | <?php (standard block) or <?= (short echo tag for inline output) |
| Closing tag | ?> - optional; intentionally omitted at the end of pure PHP files to avoid accidental whitespace output before HTTP headers |
| Execution model | Server-side; the PHP engine on the web server interprets the file and delivers the resulting HTML to the client browser |
| PHP engine | Zend Engine - the core interpreter powering the official PHP runtime, with JIT compiler support |
| CLI execution | php script.php or php -f script.php |
| Variable syntax | All variable names are prefixed with $ (e.g. $name, $count, $items) |
| Case sensitivity | Variable names are case-sensitive; function and class names are not |
| Superglobals | $_GET, $_POST, $_SESSION, $_COOKIE, $_SERVER - pre-defined arrays for HTTP request and session context |
| Major frameworks and CMS | Laravel, Symfony, CodeIgniter (frameworks); WordPress, Drupal, Joomla (content management systems) |
| Database access | Built-in MySQLi and PDO extensions; supports MySQL, PostgreSQL, SQLite, and other databases |
| Runtime configuration | php.ini controls memory limits, error reporting, file upload sizes, and which extensions are loaded |
| Related extensions | .phtml (PHP/HTML template mix), .phps (PHP source display), .php3 / .php4 / .php5 / .php7 (legacy versioned PHP scripts) |
| Released | 1995 (PHP/FI by Rasmus Lerdorf); PHP 8.x is current |
| Open standard | Yes · royalty-free |
| Specification | www.php.net |
PHP conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about PHP files.