Download the PHP package spaze/phpinfo without Composer

On this page you can find all versions of the php package spaze/phpinfo. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of spaze/phpinfo

Informations about the package phpinfo

phpinfo

Extract phpinfo() into a variable and move CSS to external file.

This might be handy when you want to show the output from phpinfo() to authenticated users only in your site's layout for example.

getHtml()

The getHtml() method returns the phpinfo() output, without the HTML head and body elements, wrapped in <div id="phpinfo"> & </div>.

All inline CSS will be "externalized" to CSS classes, you can load assets/info.css to get the colors back.

An example usage with Nette Framework (can be used with other frameworks or standalone, too):

Please note that this will also remove the HTML head element which contains meta name="ROBOTS" tag preventing search engines and other bots indexing the phpinfo() output. You have to add it back somehow, for example by rendering the getHtml() output in your own layout which includes the head element with the meta name="ROBOTS" tag. In general, phpinfo() output should be accessible only for authenticated users.

getFullPageHtml()

Sometimes, you may want to display the classic phpinfo() output, with the original HTML head and body elements, meta name="ROBOTS" tag, inline styles etc., but still with the sensitive info sanitized (see below). In that case, you may use getFullPageHtml():

Sanitization

By default, session id will be automatically determined and replaced by [***] in the output. This is to prevent some session hijacking attacks that would read the session id from the cookie value reflected in the phpinfo() output (see my blog post describing the attack, HttpOnly bypasses, and the solution). You can disable the sanitization by calling doNotSanitizeSessionId() but it's totally not recommended. Do not disable that. Please.

You can add own strings to be sanitized in the output with

If found, the string in $sanitize will be replaced with the string $with, if $with is null then the default [***] will be used instead.

Some of the values in phpinfo() output are printed URL-encoded, so the $sanitize value will also be searched URL-encoded automatically. This means that both foo,bar and foo%2Cbar would be replaced.

The sanitizer will try to determine the session id and sanitize it automatically, you can (but shouldn't) disable it with doNotSanitizeSessionId().

The following values will be used when determining the session id:

  1. session_id() output if not false
  2. $_COOKIE[session_name()] if it's a string

However, it is not recommended to rely solely on the automated way, because for example you may set the session name somewhere in a custom service, and it may not be available for the sanitizer to use. I'd rather suggest you configure the sanitization manually:

or

or something like that.

Sanitizing arbitrary strings

If you have your phpinfo() output (or anything really) in a string, you can use the sanitizer standalone, for example:

You can then pass the configured sanitizer to PhpInfo class which will then use your configuration for sanitizing the phpinfo() output too:

All versions of phpinfo with dependencies

PHP Build Version
Package Version
Requires php Version ^7.4 || ^8.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package spaze/phpinfo contains the following files

Loading the files please wait ....