Beside PHP is interpreted, version <= to PHP 5.3.4 are vulnerable to an attack commonly call null byte injection.
To declare a string in php, you use
$var = "hey" which is then equivalent in C to
char tab="hey". Notice that we declared a 4 bytes array of characters while we only want to store 3 characters. This is because compiler automatically insert the null byte character. Your final string is then
tab is a pointer which point on the first character of your string. Your computer will read from the first character to the null byte character (0 in hexadecimal) represented by
%00 is the representation of the null byte character in PHP.
When you are calling a function with a string, like
readfile("pages/$path/index.html");, your string get stored in a variable. Let's call it
$tmp=pages/pathFromVariable/index.html which in reality will be stored in memory as
Now, if you inject null byte at the end of your input, you can erase the end of the string. for example, if
$tmp=pages/pathFromVariable%00/index.html it will be stored as
pages/pathFromVariable\0/index.html\0 which will result into reading the file
pages/pathFromVariable ! Pwned !