Do file_get_contents and readfile execute PHP code?
<p>I was always sure that the PHP functions <code>file_get_contents</code> and <code>readfile</code> execute any PHP code in any files - regardless of file type - that are given to it. I tried this on multiple setups, and it always worked.</p>

<p>I received a question regarding this <a href="https://codereview.stackexchange.com/questions/125030">here</a>, and the user seems to think that this is not the case. </p>

<p>I looked at the PHP documentation for the functions, and they do not mention code execution (which is something that I would expect if this is normally the case, as it has serious security implications).</p>

<p>I also searched for it, and found a lot of claims that the functions do not execute PHP code. For example: </p>

<blockquote>
  <p>readfile does not execute the code on your server so there is no issue there. <a href="https://stackoverflow.com/questions/4799333/security-issues-with-phps-readfile-method">source</a></p>
</blockquote>

<p>Searching for "php file_get_contents code execution" also returns various questions trying to execute the retrieved PHP code, which seems odd if it would indeed normally execute any given PHP code.</p>

<p>I also found <a href="https://www.sitepoint.com/community/t/how-to-force-download-of-a-php-file-instead-of-execute-it-on-server/4173" rel="noreferrer">one question</a> that asks about not execution PHP code, so execution does seem to happen to others as well.</p>

<p>So my questions are:</p>

<ul>
<li>do the functions <code>file_get_contents</code> and <code>readfile</code> execute PHP code in retrieved files? </li>
<li>does this depend on some php.ini setting? If so, what setting(s)?</li>
<li>does it depend on the PHP version, and if so, what versions are affected?</li>
<li>if it is not normally the case, what may be the reasons that they execute the PHP code in my setups?</li>
</ul>