VMware ESXi and vSphere Cluster Management

PHP phpinfo(): View PHP Configuration and Environment Details

Learn how to use PHP phpinfo() to inspect PHP versions, php.ini files, extensions, directives, web-versus-CLI differences, and security considerations.

What phpinfo() does

phpinfo() is a built-in PHP function that generates a diagnostic page describing the active PHP installation and runtime configuration. It can show the PHP version, operating-system details, Server API, configuration files, loaded extensions, directive values, request data, and environment information.

The output describes the PHP process serving the current request. This matters because PHP used by a web server may not use the same version, extensions, or php.ini file as PHP run from a terminal.

• Check the PHP version serving a website.
• Find the active php.ini and additional parsed INI files.
• Confirm that extensions such as pdo_mysql, curl, or gd are available.
• Inspect memory, upload, execution-time, error, and session settings.
• Compare a local environment with a deployed environment.

Creating a basic phpinfo page

Create a file named phpinfo.php in the web server's document root, or in the public directory exposed by a framework. The document root is the filesystem directory from which the web server serves publicly accessible files.

<?php
phpinfo();

Open the corresponding PHP URL in a browser. For example, if the file is in the site's public directory and is named phpinfo.php, request that file through the site's normal local development address. PHP should execute the function and return a formatted diagnostic page containing a summary followed by configuration and module sections.

This must be a PHP file, not a static HTML file. The filename normally ends in .php, and the web server must be configured to pass PHP files to a PHP handler such as the Apache PHP module, CGI/FastCGI, or PHP-FPM. Do not place a diagnostic page in a publicly accessible production directory unless it is strictly protected.

Reading the phpinfo output

Top-level summary

The upper part of the page commonly identifies:

• The PHP version and system or build details.
• The build date and the Server API, also called SAPI.
• The path searched for the primary configuration file.
• The loaded configuration file, if one is active.
• Additional .ini files parsed after the main configuration file.

Server API (SAPI) is the interface through which PHP runs. Common values or contexts include CLI, an Apache module, CGI/FastCGI, and PHP-FPM. PHP-FPM means FastCGI Process Manager, a common process manager used to run PHP behind a web server.

Sections and columns

Sections commonly include Core settings, PHP Variables, Environment, HTTP headers, loaded modules, and extension-specific settings. The exact presentation can vary by PHP version and SAPI.

Configuration tables often contain a local value and a master value. The local value is the effective value for the current execution context or request. The master value is the broader configured default before a local override. A runtime call such as ini_set(), a PHP-FPM pool setting, a virtual-host rule, or another permitted override can cause these values to differ.

An effective directive value may originate from compiled defaults, the main php.ini, supplemental INI files, web-server or virtual-host configuration, PHP-FPM pool settings, or a runtime call. Therefore, changing one file does not guarantee that the browser's PHP process will use that value.

Selective output with phpinfo() flags

phpinfo() accepts an optional bitmask parameter. A bitmask is a value that combines categories using bitwise operators. Use selective output when you need one category and want to reduce unnecessary disclosure.

<?php
phpinfo(INFO_GENERAL | INFO_CONFIGURATION);

For example, INFO_GENERAL | INFO_CONFIGURATION combines two categories with the bitwise OR operator. Avoid INFO_VARIABLES and INFO_ENVIRONMENT unless that specific information is required.

Finding the correct php.ini

Use the phpinfo summary to distinguish these terms:

• Configuration file path: locations PHP searches for a primary configuration file.
• Loaded configuration file: the php.ini currently used by the PHP process. It may show that no file is loaded.
• Additional parsed INI files: supplemental files read after the main file, often used to enable extensions or override directives.

Editing an unrelated php.ini has no effect on browser behavior. For example, a terminal installation and a PHP-FPM installation may have different PHP versions and configuration directories. After changing a setting, restart or reload the applicable PHP handler, PHP-FPM pool, Apache service, or web server when required. Then refresh the diagnostic request and verify the effective value.

The terminal command below reports the CLI configuration, not necessarily the browser configuration:

php --ini

Compare its result with the browser's loaded-file and scanned-file information rather than assuming both contexts are identical.

Checking extensions and capabilities

A PHP extension is a module that adds features, such as database drivers, cURL networking, GD image processing, or multibyte string handling. Use the module section of phpinfo to verify whether commonly needed extensions are loaded:

• mysqli and pdo_mysql for MySQL access.
• curl for HTTP and other network requests.
• gd for image operations.
• mbstring for multibyte text handling.
• openssl for cryptographic and TLS-related support.
• xml for XML-related features.
• zip for archive support.
• opcache for opcode caching.

An extension section can show the extension's version and extension-specific directives. This helps diagnose a missing database driver, unavailable image support, failed cURL usage, or an opcode cache that is not enabled in the web context.

<?php
if (!extension_loaded('pdo_mysql')) {
    exit('The pdo_mysql extension is not enabled.');
}

Important directives to inspect

For uploads, post_max_size must accommodate the complete request, not only the file. It should therefore be larger than the expected upload plus multipart form overhead and other fields. Other limits may also exist in a reverse proxy or web server.

file_uploads = On
upload_max_filesize = 20M
post_max_size = 24M
memory_limit = 128M
max_execution_time = 60

Other useful directives include include_path, upload_tmp_dir, disable_functions, and expose_php. Inspect them when troubleshooting file lookup, upload temporary storage, restricted functions, or version disclosure.

Web PHP versus CLI PHP

CLI means Command-Line Interface: PHP executed from a terminal instead of in response to a web request. A browser request may use PHP-FPM, an Apache module, or CGI/FastCGI, while php in a terminal normally uses the CLI SAPI.

For a reliable comparison, check PHP version, SAPI, loaded INI path, scanned INI files, and extension lists in both contexts. A module can appear in php -m but be absent from browser phpinfo, or the reverse, because the contexts use different PHP installations, containers, pools, or configuration files.

Security and production use

A publicly reachable phpinfo page can disclose operational information useful to attackers. Depending on the selected categories, it may reveal filesystem paths, installed modules, PHP and server versions, request headers, environment variables, temporary directories, and configuration values.

• Use full phpinfo output only temporarily on a non-public development system when possible.
• If production diagnosis is unavoidable, require authentication, IP restrictions, private administrative networking, or a combination of these controls.
• Delete the diagnostic file immediately after use.
• Do not share screenshots or pasted output containing credentials, tokens, cookies, internal hostnames, or sensitive paths.
• Avoid INFO_VARIABLES and INFO_ENVIRONMENT unless those categories are specifically needed.

For example, a temporary Apache restriction could be configured as follows, subject to the server's access-control setup:

<Files "phpinfo.php">
    Require ip 127.0.0.1 ::1
</Files>

An equivalent Nginx location must be adapted to the actual PHP-FPM socket and site configuration:

location = /phpinfo.php {
    allow 127.0.0.1;
    allow ::1;
    deny all;
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}

Safer targeted alternatives

A small diagnostic script is often safer and easier to automate than a full phpinfo page:

<?php
header('Content-Type: text/plain');
echo 'PHP version: ' . PHP_VERSION . PHP_EOL;
echo 'SAPI: ' . PHP_SAPI . PHP_EOL;
echo 'Loaded php.ini: ' . (php_ini_loaded_file() ?: 'none') . PHP_EOL;
echo 'cURL loaded: ' . (extension_loaded('curl') ? 'yes' : 'no') . PHP_EOL;
echo 'memory_limit: ' . ini_get('memory_limit') . PHP_EOL;

Useful targeted functions include:

• phpversion() for a PHP or extension version.
• extension_loaded() to test an extension.
• function_exists() to test whether a function is available.
• ini_get() to read an effective directive value.
• ini_set() to request a runtime setting change where the directive permits it.
• get_loaded_extensions() to list loaded extensions.
• php_ini_loaded_file() to identify the loaded main INI file.
• php_ini_scanned_files() to identify additional parsed INI files.
• php_sapi_name() to identify the SAPI.

Command-line checks complement, but do not replace, a browser check:

php -v
php -m
php --ini
php -i
php -r "echo ini_get('memory_limit'), PHP_EOL;"

Troubleshooting common problems

The browser displays PHP source code

• Verify that the filename ends in .php.
• Confirm PHP is installed and enabled for the web server.
• Check that the server passes PHP files to its PHP handler or FastCGI configuration.
• Review web-server and PHP-FPM logs.

Changing php.ini has no effect

• Read the loaded configuration file and additional parsed INI files shown by browser phpinfo.
• Compare those paths with php --ini, without assuming CLI and web PHP are identical.
• Check local and master values for overrides.
• Reload or restart the correct PHP handler, PHP-FPM pool, Apache service, or web server, then test again.

An extension differs between CLI and the browser

Compare the PHP version, SAPI, loaded INI path, scanned files, and module sections. Enable the extension in the configuration used by the failing context, not merely in the CLI installation.

Uploads fail despite a large upload_max_filesize

Inspect upload_max_filesize, post_max_size, file_uploads, upload_tmp_dir, disk capacity, permissions, and web-server request-body limits. Ensure post_max_size exceeds the file size plus form overhead.

Development errors are not visible

Inspect display_errors, log_errors, error_reporting, and error_log. Visible errors can help locally, but production systems should generally log errors without exposing implementation details in responses.

The diagnostic page is exposed

Remove the file immediately. If it may have displayed secrets, invalidate or rotate those secrets. For future investigations, use a short-lived, access-controlled, targeted diagnostic page.

Exam-relevant notes

• phpinfo() reports the configuration of the PHP process handling the current request.
• CLI PHP and web PHP can use different SAPIs, versions, extensions, and INI files.
• The loaded configuration file is more useful than an assumed filesystem location.
• post_max_size applies to the whole POST request and must accommodate uploaded files plus form data.
• Local and master directive values can differ because of context-specific or runtime overrides.
• A full phpinfo page is a diagnostic tool, not a page to leave publicly available.

For related study, see PHP configuration and phpinfo diagnostics.