2
... is it theoretically possible for an attacker to obtain the php source-code in plain text by doing things with the url?
There is no inherent feature within a web server or a URL which makes it possible to get the source code of a PHP file from remote.
But, this does not mean that it is impossible in all cases. For example a bad server configuration ...
1
Here's why it's hard to get the source code of a php program from a properly configured web server.
php web apps are hosted in web server software like apache and nginx. Those servers' configuration files are rigged so they don't deliver files with names ending in .php, but rather pass them to the program that runs the php script interpreter. In nginx ...
Only top voted, non community-wiki answers of a minimum length are eligible
