Since it's serverside it shouldn't have access to the visitor's computer.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
PHP runs on the server; it is code which ultimately produces a Web page to be returned to the client. From the client point of view, only the received bytes matter, not how they were computed on the server; it makes no difference whatsoever to the client if the Web page was dynamically generated with PHP or Java or whatever, or if it was the contents of a statically served file.
So there is no specific "PHP powered" client infection which can take place, and which would not have been equally infectious if done server-side with any other technology.
Of course, mere rational thinking should not prevent anybody from laying blame. When the Black Death scourged Europe in medieval times, it was (probably) due to a pathogen agent relayed by fleas who were carried by rats; so the rats were not really responsible, being at worst second-level indirect accomplices. Yet they took the full force of the blame.
Similarly, while PHP is by no means responsible for client infection, incautiously written PHP server code can make servers vulnerable to hostile takeover, which can result in turning them into vectors of infection for clients (using one of the myriad security holes in client browsers). So it is possible to say, with only the minutest dose of unfairness, that PHP can be considered somewhat harmful to clients.
Well as you said, PHP is server side so that means that the code is executed inside the server and the browser will just interpret the response.
So PHP files doesn't have effect upon client's computer, because there is no code execution in it.
Edit: We are just talking about PHP and no other things.