phpinfo PHPSave: Complete Guide to Saving PHP Configuration Output Securely (2025)

What Is phpinfo() and Why Would You Want to Save Its Output?

The phpinfo() function is a built-in PHP diagnostic tool that outputs a detailed page showing the current state of your PHP installation. It reports the PHP version, compiled-in modules, server API, configuration directives, environment variables, and bootstrap constants.

Developers and sysadmins typically want to save phpinfo output for several reasons:

• Documentation — Maintain a reference snapshot of the PHP environment across deployments.
• Troubleshooting — Compare configurations between staging and production to spot mismatches.
• Auditing — Verify that required extensions are loaded and insecure settings are disabled.
• Support tickets — Share a sanitized copy with hosting providers or framework maintainers.

How Does phpinfo PHPSave Actually Work?

PHP's output buffering layer makes it straightforward to capture the output of phpinfo() into a variable, then write that variable to disk. The core pattern looks like this:

<?php
// Start output buffering
ob_start();

// Generate the phpinfo dump (only configuration section)
phpinfo(INFO_CONFIGURATION);

// Capture the output
$infoOutput = ob_get_clean();

// Save to a file
$filename = 'phpinfo-report-' . date('Y-m-d-His') . '.html';
file_put_contents($filename, $infoOutput);

echo "Saved to: $filename";
?>

This approach gives you a timestamped HTML report that can be reviewed offline or version-controlled without exposing the endpoint live on the server.

Step-by-Step: How to Save phpinfo Output to a File

Follow these steps to safely generate and save a phpinfo report on any PHP environment (CLI or web).

Step 1 — Create a Diagnostic Script

Build a dedicated PHP file (e.g., save-phpinfo.php) in a restricted or private directory. Never place it in your public web root.

<?php
/**
 * Save PHP info report — for diagnostic use only.
 * DELETE THIS FILE after use.
 */

// Only run in controlled environments
if (php_sapi_name() === 'cli') {
    header('Content-Type: text/plain');
}

$flags = INFO_GENERAL | INFO_CONFIGURATION | INFO_MODULES;
$flags |= INFO_ENVIRONMENT | INFO_VARIABLES | INFO_LICENSE;

ob_start();
phpinfo($flags);
$report = ob_get_clean();

$dir = dirname(__FILE__) . DIRECTORY_SEPARATOR . 'reports';
if (!is_dir($dir)) {
    mkdir($dir, 0700, true);
}

$filename = $dir . DIRECTORY_SEPARATOR . 'phpinfo-' . date('Y-m-d-His') . '.html';
file_put_contents($filename, $report);

echo "Report saved: $filename\n";
echo "Size: " . round(strlen($report) / 1024, 1) . " KB\n";
?>

Step 2 — Run the Script

From the command line:

$ php save-phpinfo.php
Report saved: ./reports/phpinfo-2025-07-14-103215.html
Size: 87 KB

Or via a browser, but only if the script resides behind authentication.

Step 3 — Review and Clean Up

Open the generated HTML report in a browser to verify contents. Once the diagnostic task is complete:

1. Delete the report file(s) from the server.
2. Remove the save-phpinfo.php script entirely.
3. Audit your server logs to confirm no unauthorized access occurred.

phpinfo() Output Flags: What Each Flag Exposes

Understanding which flag to use is critical for minimizing data exposure when saving phpinfo output.

Recommendation: For most debugging scenarios, use INFO_GENERAL | INFO_CONFIGURATION | INFO_MODULES (flags 1 + 2 + 4 = 7). Avoid INFO_ENVIRONMENT and INFO_VARIABLES unless you have a specific reason and a secure channel for handling the output.

Security Risks of phpinfo Exposure