phpinfo() PHP Save: Complete Guide to Safely Exporting & Preserving PHP Configuration Data

If you've ever called phpinfo() and wondered how to preserve that output for documentation, migration, or auditing purposes, you're in the right place. This guide covers everything developers need to know about saving phpinfo data securely and effectively.

Key Takeaways

• phpinfo() outputs to the browser by default — use INFO_ALL with output buffering to capture it as a string.
• Never save raw phpinfo output to a publicly accessible file — it exposes sensitive server details including paths, extensions, and environment variables.
• Use ob_start() combined with file_put_contents() to write sanitized phpinfo data to disk reliably.
• Strip sensitive data before saving — remove PATH, HOME, DOCUMENT_ROOT, and custom env variables from the saved output.
• Consider alternatives like php -i or --ri for CLI-based extraction when browser output isn't available.

What Is phpinfo() and Why Would You Want to Save It?

The phpinfo() function displays a comprehensive report of your PHP environment — loaded modules, compilation flags, server API, configuration directives, and environment variables. While it's primarily a debugging and diagnostics tool, there are legitimate reasons to save its output:

• Server migration documentation — compare PHP configurations across staging and production environments.
• Audit and compliance reporting — maintain a record of your PHP setup for security reviews.
• Troubleshooting history — archive phpinfo output before and after making configuration changes.
• Deployment verification — confirm that your deployment pipeline applied the correct PHP settings.

How to Save phpinfo() Output in PHP

By default, phpinfo() writes directly to the output buffer. To capture it as a string you can save, you need to wrap the call in PHP's output control functions.

Method 1: Output Buffering (Recommended)

<?php
// Start output buffering
ob_start();

// Generate phpinfo and capture as string
phpinfo(INFO_ALL);

// Get the buffered content
$info = ob_get_clean();

// Sanitize before saving — remove sensitive paths and env vars
$sanitized = preg_replace('/<tr class="h">[^<]*SERVER\[.*?<\/tr>/is', '', $info);
$sanitized = preg_replace('/<tr class="e">[^<]*PATH.*?<\/tr>/is', '', $sanitized);
$sanitized = preg_replace('/<tr class="e">[^<]*HOME.*?<\/tr>/is', '', $sanitized);
$sanitized = preg_replace('/<tr class="e">[^<]*DOCUMENT_ROOT.*?<\/tr>/is', '', $sanitized);

// Save to a timestamped file
$filename = 'phpinfo-' . date('Y-m-d-His') . '.html';
file_put_contents($filename, $sanitized);

echo "phpinfo saved to: " . htmlspecialchars($filename);
?>

Method 2: Using php_info() Constants Selectively

If you only need specific sections, you can pass flags to phpinfo() to reduce output size and sensitivity:

phpinfo() Flag Constants and Their Output

Flag	Output Section	Includes Sensitive Data?
INFO_GENERAL	PHP version, build date, server API	No
INFO_CONFIGURATION	All php.ini directives and values	Partially
INFO_MODULES	Loaded extensions and their settings	No
INFO_ENVIRONMENT	Environment variables ($_ENV)	Yes
INFO_VARIABLES	All predefined variables including $_SERVER	Yes
INFO_ALL	All of the above combined	Yes

Method 3: CLI Approach with php -i

For headless environments or automated scripts, the CLI binary provides a cleaner output format:

# Save full phpinfo to a file via CLI
php -i > /path/to/phpinfo-report.txt

# Save only a specific module's info
php --ri pdo_mysql > /path/to/pdo-info.txt

# Machine-parseable output
php -i --json > /path/to/phpinfo.json

The --json flag (available in PHP 8.1+) is particularly valuable for programmatic analysis and comparison workflows.

Security Checklist: Before Saving phpinfo Output

Before writing any phpinfo data to disk, run through this checklist to ensure you're not leaking sensitive information:

• [ ] Remove $_SERVER entries — paths, document root, script filenames, and agent strings are all included.
• [ ] Remove $_ENV entries — environment variables often contain API keys, database credentials, and internal hostnames.
• [ ] Remove custom php.ini values — some custom directives may contain secrets or internal configuration details.
• [ ] Restrict file permissions — set the saved file to 0600 or 0640 so only the owning user can read it.
• [ ] Store outside the web root — never save phpinfo output in a directory reachable via HTTP.
• [ ] Set an expiration policy — automate deletion of old reports (e.g., rotate weekly or monthly).
• [ ] Encrypt sensitive saves — if the report must include environment data, encrypt the file before writing it.
• [ ] Log access to the saved file — track who retrieves the phpinfo report for audit trails.

Comparing phpinfo() Save Methods

Comparison of Methods for Saving phpinfo Output

Method	Best For	Sensitivity Risk	Ease of Use	Automation-Friendly
Output buffering + file_put_contents()	Web applications needing on-demand snapshots	Medium (requires sanitization)	Easy	Partial
php -i CLI redirect	Servers without web access; CI/CD pipelines	Low (no $_SERVER noise)	Very easy	Full
php --json CLI	Programmatic analysis and diffing	Low (structured, easier to filter)	Easy	Full
Third-party diagnostic scripts	Teams needing standardized reporting	Varies