I see a security concern in introducing a new file extension.

It's common to configure a web server to pass locations that end with .php
to a PHP interpreter.

Nginx example:

```
location ~ \.php$ {
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/run/php/php8.2-fpm.sock;
}
```

Apache2 example:

```
<FilesMatch \.php$>
    SetHandler application/x-httpd-php
</FilesMatch>
```

With a new file extension, users would be forced to change their configs,
or a direct request to .phpX file would expose its source code.

This will come as a surprise to users who don't know about the pure syntax
yet include libraries that use it.

Reply via email to