If my website does not take any user input, is there any danger in showing my code and folder structure?

Question

First time posting here; apologies for any mistakes I've made, please edit, retag, migrate as appropriate.

I have a simple homepage whose purpose is (essentially) to contain my contact info and some pdf's. Over time this has become a bit of a side project for me, adding content and making it fancier with Javascript and PHP, though only using a microscopic piece of what they can do: include one file in another file, change this div's background, get the current date, etc. I recently used my first $_GET.

In the interests of documenting my work, satisfying the curiosity of anyone who wants to look at my amateur code, possibly getting feedback on how to improve things, and just general openness, I am thinking of discussing, or otherwise making visible,

• the PHP code I've used
• the inner structure of my public_html folder on my department's server
• (am I correct that any Javascript I use is necessarily going to be visible?)

However, I am concerned that this would open my website, or the server overall, to attack. Since my website does not take user input anywhere, I feel secure, but I'd like to be sure before proceeding.

If it would help in your analysis, I can give a list of the PHP and Javascript functions I have used so far.

Answer 1

You have made a small mistake. Your web server does take user input. In the URL bar. If you have not configured PHP securely then this is a serious security issue.

Risks include having your code compromised or website defaced.

Answer 2

If you have phpMyAdmin or cPanel on your site, there's a (un)surprising number of vulnerabilities found in many of those versions. Keep them up to date.

It's possible that exposing your folder structure and PHP source may expose some vulnerabilities that you've introduced or made available, and if a malicious individual found it before a benevolent one, your site could be compromised.