I was always sure that the PHP functions `file_get_contents` and `readfile` execute any PHP code in any files - regardless of file type - that are given to it. I tried this on multiple setups, and it always worked.

I received a question regarding this [here](https://codereview.stackexchange.com/questions/125030), and the user seems to think that this is not the case. 

I looked at the PHP documentation for the functions, and they do not mention code execution (which is something that I would expect if this is normally the case, as it has serious security implications).

I also searched for it, and found a lot of claims that the functions do not execute PHP code. For example: 

> 
> readfile does not execute the code on your server so there is no issue there. [source](https://stackoverflow.com/questions/4799333/security-issues-with-phps-readfile-method)
> 
> 
> 

Searching for "php file\_get\_contents code execution" also returns various questions trying to execute the retrieved PHP code, which seems odd if it would indeed normally execute any given PHP code.

I also found [one question](https://www.sitepoint.com/community/t/how-to-force-download-of-a-php-file-instead-of-execute-it-on-server/4173) that asks about not execution PHP code, so execution does seem to happen to others as well.

So my questions are:

* do the functions `file_get_contents` and `readfile` execute PHP code in retrieved files?
* does this depend on some php.ini setting? If so, what setting(s)?
* does it depend on the PHP version, and if so, what versions are affected?
* if it is not normally the case, what may be the reasons that they execute the PHP code in my setups?