Your code is split into two entirely separate parts, the server side and the client side.
|
---------->
HTTP request
|
+--------------+ | +--------------+
| | | | |
| browser | | | web server |
| (JavaScript) | | | (PHP etc.) |
| | | | |
+--------------+ | +--------------+
|
client side | server side
|
<----------
HTML, CSS, JavaScript
|
The two sides communicate via HTTP requests and responses. PHP is executed on the server and outputs some HTML and maybe JavaScript code which is sent as response to the client where the HTML is interpreted and the JavaScript is executed. Once PHP has finished outputting the response, the script ends and nothing will happen on the server until a new HTTP request comes in.
The example code executes like this:
<scripttype="text/javascript">var foo ='bar';<?php
file_put_contents('foo.txt',' + foo + ');?>var baz =<?php echo 42;?>;
alert(baz);</script>
Step 1, PHP executes all code between <?php ?>
tags. The result is this:
<scripttype="text/javascript">var foo ='bar';var baz =42;
alert(baz);</script>
The file_put_contents
call did not result in anything, it just wrote " + foo + " into a file. The <?php echo 42; ?>
call resulted in the output "42", which is now in the spot where that code used to be.
This resulting HTML/JavaScript code is now sent to the client, where it gets evaluated. The alert
call works, while the foo
variable is not used anywhere.