Scan in the browser

Paste phpinfo() output, a php.ini, .user.ini, PHP-FPM pool or .htaccess and get the same report as the command-line scanner.

Scan #

Getting the output safely #

The scanner needs only the version, SAPI, loaded ini files, directives and extensions. This script prints exactly that, in a format the scanner reads like phpinfo() output:

<?php
header('Content-Type: text/plain');
header('Cache-Control: no-store');
// Credentials only need to be known as set; URLs (session.save_path, DSNs) can embed them too.
$show = fn ($name, $value) => (string) $value === '' ? 'no value'
    : (preg_match('/(^|[._])(pw|pass|passwd|password|secret|token|auth|license|licence|api_?key)$/i', $name) ? '(set)'
    : preg_replace(['#(://)[^/@\s]*@#', '/([?&;]\s*(?:pw|pass|passwd|password|secret|token|auth|api_?key)\w*=)[^&;,\s]*/i'],
        ['$1(set)@', '$1(set)'], $value));
echo 'PHP Version => ', PHP_VERSION, "\nServer API => ", PHP_SAPI, "\nSystem => ", PHP_OS_FAMILY,
    "\nLoaded Configuration File => ", php_ini_loaded_file() ?: '(none)',
    "\nAdditional .ini files parsed => ", str_replace(",\n", ', ', trim((string) php_ini_scanned_files())) ?: '(none)', "\n\n";
foreach (ini_get_all(null, true) as $name => $value) {
    echo $name, ' => ', $show($name, $value['local_value']), ' => ', $show($name, $value['global_value']), "\n";
}
foreach (get_loaded_extensions() as $extension) {
    echo "\n", $extension, "\n";
}

• Upload it under a long random name (e.g. 64 characters) ending in .php, open it in the browser or with curl, and delete it right after. Never commit or deploy it.
• If you use phpinfo() instead, limit it to phpinfo(INFO_GENERAL | INFO_CONFIGURATION | INFO_MODULES). Under Apache mod_php that still lists request headers.
• php -i needs no web page, but shows the CLI configuration, which usually differs from FPM or Apache.
• Directive values can still contain secrets, such as a password in session.save_path. Don't paste the output into issues, chats or other online tools.
• If a full phpinfo() page was ever public, rotate the credentials it showed.

Inputs #

• phpinfo() output (HTML source, copied page or php -i): the values PHP actually runs with, including pool, .user.ini and .htaccess overrides, and the exact version.
• php.ini (php --ini shows the path): syntax errors, typos and redefinitions; unset directives fall back to PHP's defaults. Enter the PHP version to match known vulnerabilities.
• .user.ini: overrides on PHP's defaults, and settings PHP ignores there. Choose it explicitly; it looks like a php.ini snippet.
• PHP-FPM (php-fpm.conf or a pool such as www.conf): pool settings and php_admin_value overrides.
• .htaccess: php_value/php_flag overrides and handlers that execute non-PHP files.

One input is audited at a time. To combine php.ini, its scan directory, pools and overlays, use the command-line scan.