I'm trying to get a handle on the difference between certain web languages and the security implications of each. Specifically this is with regards to executing code in the context of the web browser on the server side.
With other languages such as PHP you could also have a piece of information included in a web page which also contains valid PHP code such as
<php phpinfo(); ?>. The server parses over this code and executes it as valid PHP, triggering the PHP information display.
My question is - at what stage does the code have to be within the page before the browser will treat it as valid code for the language?
I.e. Could you have a XSS vulnerability turn into code execution because someone injects PHP code instead and the server parses it?
Would this be different for something like a stored XSS* vulnerability vs say a reflected XSS vulnerability?
Is there such as thing as DOM execution of PHP code?
* When I say XSS I simply mean unsanitized and unescaped code being passed to the server.