PHPInfo PHP Save: The Definitive Guide to Capturing, Storing & Securing phpinfo() Output

What Is phpinfo() and Why Do Developers Need to Save Its Output?

Understanding the phpinfo() Function

The phpinfo() function is a built-in PHP utility that outputs a detailed HTML page containing everything about your PHP installation: version numbers, compiled-in modules, server API, configuration directives (php.ini values), environment variables, HTTP headers, and license information. It was designed as a rapid diagnostic tool for developers and system administrators.

Why Saving phpinfo Output Matters

While displaying phpinfo directly in a browser is convenient for one-off debugging, saving the output serves several professional purposes:

• Deployment audits — Compare configuration states before and after migrations.
• Compliance documentation — Record PHP settings for security reviews and PCI/DSS audits.
• Issue reproduction — Attach saved phpinfo snapshots when reporting bugs to PHP contributors.
• Multi-server consistency checks — Verify that all nodes in a cluster share identical PHP configurations.
• Forensic analysis — Preserve configuration evidence after a security incident.

How to Save phpinfo() Output: Three Proven Methods

Method 1: Output Buffering to File (Recommended)

<?php
// Capture phpinfo without displaying it
ob_start();
phpinfo();
$info = ob_get_clean();

// Save to a timestamped file
$filename = 'phpinfo-' . date('Y-m-d-His') . '.txt';
file_put_contents($filename, $info);

echo "Saved to: $filename";
?>

Method 2: Command-Line Redirection

For server administration tasks, running phpinfo from the CLI and redirecting output is the fastest approach:

php -r 'phpinfo();' > phpinfo-save-$(date +%Y%m%d).txt

Or using PHP's built-in server mode for remote capture:

curl -s http://localhost/info.php > phpinfo-production.txt

Method 3: XML Output Format (Structured Data)

PHP supports structured output via the INFO_ALL constant and XML formatting, which is ideal for programmatic parsing and integration into CI/CD pipelines:

<?php
// Generate XML-formatted phpinfo
echo '' . "\n";
phpinfo(INFO_GENERAL | INFO_CONFIGURATION | INFO_MODULES);
?>

Save with a .xml extension and parse with standard XPath queries.

Comparison: phpinfo Save Methods at a Glance

Critical Security Risks of Exposed phpinfo() Pages

What Attackers Can Discover From phpinfo

An exposed phpinfo page is a reconnaissance goldmine. The following details are commonly leveraged in attack planning:

• PHP Version & Architecture — Identifies known CVEs applicable to your exact build (e.g., PHP 7.4.33 with known buffer overflow vulnerabilities).
• Server API (SAPI) — Reveals whether you're running Apache mod_php, PHP-FPM, CGI, or CLI, each with distinct attack surfaces.
• Absolute Path Information — Full filesystem paths enable local file inclusion (LFI) and path traversal attacks.
• Loaded Extensions & Versions — Outdated or vulnerable extensions (e.g., old OpenSSL, ImageMagick) become immediate targets.
• Environment Variables — Database credentials, API keys, and internal hostnames may appear in _ENV or _SERVER arrays.
• Open_basedir & disable_functions Status — Confirms whether key security restrictions are actually active.

Essential Security Checklist for phpinfo Usage