PHP Code Displayed Instead of Executed: Server Configuration and PHP Tags

PHP runs on the web server before HTML is sent to the browser. If PHP source appears in the browser, the server is sending the file as plain text instead of passing it to PHP, or the code uses PHP syntax that is not enabled. You will learn how to verify that XAMPP is serving the file correctly, test PHP processing, and use the portable <?php opening tag.

PHP is a server-side language. The browser should never receive normal PHP source code.

When a browser requests a PHP file, the expected sequence is:

1. The browser requests a URL such as http://localhost/my-project/index.php.
2. Apache recognizes the .php file extension.
3. Apache sends the file to the PHP interpreter.
4. PHP executes the code and produces output, usually HTML.
5. Apache sends only that output to the browser.

For example, the browser receives this:

<p>Hello, Ada!</p>

—not this:

<?php echo "Hello, Ada!"; ?>

If raw PHP appears in page source, it is an important configuration and security warning: PHP has not processed that content. This can expose application code, paths, credentials, and database configuration.

There are two especially relevant issues in the provided code:

• The file may be served by something other than Apache/PHP, such as opening it directly from disk or using an incorrect server location.
• <? is a short PHP opening tag. It works only when the PHP short_open_tag setting is enabled. Use <?php instead because it is always supported.

Think of Apache as a restaurant waiter and PHP as the kitchen.

• A request for an HTML file is like ordering a bottled drink: Apache can hand it directly to the browser.
• A request for a PHP file is like ordering a cooked meal: Apache must send the file to PHP first, and PHP returns the finished result.

If the browser receives PHP code itself, Apache has handed over the recipe instead of sending it to the kitchen. Either PHP is not connected to Apache for that request, or PHP did not recognize the code as PHP.

The <?php tag is the clear label that tells PHP, “the instructions begin here.” The shorter <? label may not be accepted by the server configuration.

Use the full PHP opening tag:

<?php
include_once __DIR__ . "/code/configs.php";

A basic PHP test file named test.php can contain:

<?php
echo "PHP is working";

When you visit it through XAMPP, for example:

http://localhost/my-project/test.php

the page should display:

PHP is working

The page source should contain only that text, not the <?php ... ?> code.

Prefer <?php over <?

<?
echo "May not run";
?>

The preceding code depends on the short_open_tag PHP configuration setting. It is not portable.

<?php
echo "Runs regardless of short_open_tag";

The full opening tag is the standard choice for PHP files.

Including a project file safely

<?php
include_once __DIR__ . "/code/configs.php";

__DIR__ means “the directory containing the current PHP file.” It helps make the include path independent of the server's current working directory.

Avoid assuming this is a project-relative path:

<?php
include_once "/code/configs.php";

A path beginning with / is usually an absolute filesystem path on the server, such as /code/configs.php, not automatically a path from your website's root.

Consider this file:

<?php
$name = "Mina";
echo "Hello, " . $name;

When requested at http://localhost/example/index.php, this happens:

1. The browser sends a request for /example/index.php.
2. Apache finds index.php inside its configured web root, such as XAMPP's htdocs folder.
3. Apache passes the file contents to the PHP interpreter.
4. PHP assigns "Mina" to $name.
5. PHP joins "Hello, " and $name.
6. PHP sends Hello, Mina as output.
7. Apache returns that output to the browser.

The browser does not know that $name existed. It only receives:

Hello, Mina

If the browser instead receives the original <?php code, steps 3 through 6 did not occur for that request.

PHP processing is needed whenever a page must generate a response on the server, including:

• Login pages: Verify a password and create a session before returning a response.
• Database pages: Query products, articles, or user records and render them as HTML or JSON.
• Configuration loading: Include environment-specific settings such as database host names.
• Form handling: Validate submitted data and save it to a database.
• APIs: Return JSON from PHP code, for example a list of orders.
• Access control: Check whether a user is authorized before serving private content.

In all of these cases, clients should receive the resulting HTML or JSON, never the PHP implementation or secret configuration values.

In projects, developers usually verify server-side PHP with a small health-check route or file during setup:

<?php
header("Content-Type: text/plain");
echo "PHP is available";

They also use full tags consistently:

<?php
// Application code

A common configuration-loading pattern is:

<?php
require_once __DIR__ . "/config/config.php";

Use require_once when the application cannot work without the file. PHP stops with an error if it is missing. Use include_once when the included file is optional or the program can continue without it.

For real applications, keep sensitive configuration files outside the public web directory when possible. Even with correct PHP setup, this reduces the risk of accidental exposure if the server is misconfigured.

When diagnosing a local server, developers check these items in order:

1. The browser URL uses http://localhost/..., not a file:///... path.
2. The project is inside Apache's configured document root or virtual-host directory.
3. Apache and PHP are installed and connected in the active XAMPP configuration.
4. A minimal <?php echo "ok"; file executes.
5. The PHP error log is checked for startup or configuration errors.

Opening the file directly from the filesystem

This bypasses Apache and PHP:

file:///C:/xampp/htdocs/my-project/index.php

Use a server URL instead:

http://localhost/my-project/index.php

Using the short opening tag

This may be treated as ordinary text when short_open_tag is disabled:

<?
echo "Hello";
?>

Use the portable full tag:

<?php
echo "Hello";

Assuming the .php extension alone guarantees execution

A .php extension is necessary in many setups, but Apache must also be configured to send .php files to PHP. A static server, a misconfigured virtual host, or a wrong Apache configuration can still send the file unchanged.

Testing a complex page first

An include, framework bootstrap, or template can make the issue harder to isolate. Start with:

<?php
echo "ok";

If this does not run, the problem is server setup, not your application code.

Using an incorrect include path

This path starts at the server filesystem root, not necessarily your project folder:

<?php
include_once "/code/configs.php";

For a code directory next to the current file, use:

<?php
include_once __DIR__ . "/code/configs.php";

Leaving exposed PHP source online

Do not ignore source code appearing in the response. Remove public access until PHP handling is fixed, especially if files contain passwords, API keys, or database credentials.

<?php
// Standard PHP opening tag

echo "Hello";

// Include a file relative to this file's directory
require_once __DIR__ . "/config/config.php";

• Request PHP through a web server URL: http://localhost/...
• Do not open PHP files using file:///...
• Use <?php, not <?
• Test PHP handling with <?php echo "ok";
• Place local XAMPP projects in the configured Apache document root, commonly xampp/htdocs
• If PHP source is visible, treat it as a server configuration/security problem
• A leading / in an include path commonly means an absolute server filesystem path
• Check Apache and PHP error logs when a minimal test file fails

Why does my browser show PHP code instead of running it?

The file was sent to the browser without being processed by PHP. Usually you opened it outside a server, used a server without PHP configured, or Apache is not passing .php files to PHP.

Does naming a file .php make it execute automatically?

No. The file must also be requested through a web server configured with PHP support, such as Apache in a correctly configured XAMPP installation.

Should I use <? or <?php in PHP files?

Use <?php. The shorter <? tag depends on the short_open_tag setting and may display as plain text.

How can I quickly test whether XAMPP executes PHP?

Create test.php in your project with <?php echo "PHP works"; and visit it at http://localhost/your-project/test.php.

Why does file:///C:/.../index.php not run PHP?

That URL tells the browser to read a local file directly. It does not send a request to Apache, so PHP has no chance to execute it.

Why might my included file still fail after PHP starts working?

The include path may be wrong. Use __DIR__ with a relative path, such as require_once __DIR__ . "/code/configs.php";.

Is showing raw PHP source dangerous?

Yes. PHP files can contain database passwords, API keys, business logic, and filesystem details. Fix the server configuration before deploying or sharing the site.

• Apache document root — Determines which local project files Apache can serve.
• PHP installation and handlers — Connects Apache requests for .php files to the PHP interpreter.
• PHP opening tags — Explains why <?php is safer than <?.
• Local development servers — Covers using localhost instead of opening project files directly.
• PHP include and require — Helps organize code across multiple PHP files.
• Absolute and relative file paths — Important for correctly locating included configuration files.
• PHP error logs — Useful for diagnosing server and application failures.
• Web server security — Raw server-side source exposure is a critical configuration issue.