# [Pre-RFC] Pure-code source files via .phpc extension

- Thread: https://externals.io/message/131034
- Original archive: https://news-web.php.net/php.internals/131034
- Started by go.al.ni@gmail.com on 2026-05-28T09:10:22+00:00
- Messages: 1
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · RFCs at https://externals.io/rfc.md · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #131034 — go.al.ni@gmail.com — 2026-05-28T09:10:22+00:00

URL: https://externals.io/message/131034#131034

I see a security concern in introducing a new file extension.

It's common to configure a web server to pass locations that end with .php
to a PHP interpreter.

Nginx example:

```
location ~ \.php$ {
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/run/php/php8.2-fpm.sock;
}
```

Apache2 example:

```
<FilesMatch \.php$>
    SetHandler application/x-httpd-php
</FilesMatch>
```

With a new file extension, users would be forced to change their configs,
or a direct request to .phpX file would expose its source code.

This will come as a surprise to users who don't know about the pure syntax
yet include libraries that use it.