note 11379 added to show_source

Two little comments and suggestions: First of all.. ($DOCUMENT_ROOT . $filename) is not that secure.. Someone could ask for a filename of /../../../etc/passwd and if you eval $DOCUMENT_ROOT . "/../../../etc/passwd", it would get to the real "/etc/passwd". One solution would be to: $try_file = realpath(dirname($filename)); if (ereg("^" . $DOCUMENT_ROOT, $try_file)) { ... } Second thing, if you want to further process the show_source(), maybe to strip passwords, you can try this little trick -- I am not responsible of incompatibilities with some webserv. ;) ob_start(); show_source($DOCUMENT_ROOT . $filename); $buffer = ob_get_contents(); ob_end_clean(); print($buffer); Hope this could help - Olivier http://www.php.net/manual/en/function.show-source.php