show_source()

In this article, we will focus on the PHP show_source() function. We will cover its syntax, parameters, and return value, show working examples, explain when to use it, and walk through the security risks you need to avoid.

What is the show_source() function?

The show_source() function reads a PHP file and prints its contents to the browser as HTML with syntax highlighting — keywords, strings, and comments are wrapped in colored <span> tags so the code is easy to read.

show_source() is an alias of highlight_file(). The two functions are identical in every way; show_source() exists mainly for readability. (Do not confuse it with highlight_string(), which highlights a string of code you pass in directly rather than a file on disk.)

Syntax

show_source(string $filename, bool $return = false): string|bool

Return value: when $return is false, it prints the highlighted code and returns true on success or false on failure. When $return is true, it returns the highlighted HTML as a string (and prints nothing).

Basic usage

Pass the path of the file you want to display. The highlighted output is written straight to the page:

<?php
$file = 'example.php';
show_source($file);
?>

This prints the contents of example.php to the browser, wrapped in <code> and colored <span> tags. Because the output is HTML, it is meant to be viewed in a browser, not on the command line.

Capturing the output instead of printing it

Set the second argument to true when you want the highlighted HTML as a string — for example to log it, cache it, or insert it into a template:

<?php
$highlighted = show_source('example.php', true);

// $highlighted now holds the HTML markup, e.g.:
// <code><span style="color: #0000BB">&lt;?php ... </span></code>
echo strlen($highlighted) . " bytes of HTML\n";
?>

Nothing is sent to the browser until you echo the captured string yourself.

When would I use it?

• Documentation and tutorials — show readers an example file exactly as it appears on disk, with highlighting.
• Debugging in development — quickly inspect what a file actually contains.
• Code-snippet viewers — combine the $return = true mode with your own templating.

For just reading a file's raw contents (no highlighting), use file_get_contents() or readfile() instead.

Security considerations

show_source() exposes the full source code of a file, including any logic, comments, and credentials it contains. Treat it as a development-only tool.

The biggest risk is passing user input as the filename. If a request parameter ends up in show_source(), an attacker can read arbitrary files on your server:

<?php
// DANGEROUS — never do this
show_source($_GET['file']);   // ?file=../config/database.php
?>

To stay safe:

• Never pass unvalidated user input as the filename. Whitelist the allowed files instead of trusting the request.
• Keep show_source() out of production. Source highlighting belongs in development environments and documentation pages, not on a live site.
• Be mindful that highlighted source may reveal database passwords, API keys, or other secrets hard-coded in the file.

Summary

• show_source() prints a PHP file's source code as syntax-highlighted HTML.
• It is an alias of highlight_file(); both behave identically.
• The optional second argument ($return) returns the HTML as a string instead of printing it.
• Never feed user input into it, and keep it out of production — it can leak your entire source code.

Practice