readFile

Readfile is a PHP built-in function that reads a file and writes its contents to the output buffer. It streams data directly to the client, which makes it suitable for serving large files without loading the entire file into PHP memory. On success it returns the number of bytes read; on failure it returns false.

Syntax and behavior: readfile(string $filename, bool $use_include_path = false, resource $context = null). The function outputs the file as it reads it and returns the number of bytes read. If the file cannot be opened, it returns false. If allow_url_fopen is enabled, readfile can read from a URL, otherwise it acts only on local filesystem paths. The behavior can be affected by output buffering.

Usage: Typical usage is readfile('path/to/file.ext'); The second parameter enables searching the include_path, and the third provides a stream context. When output buffering is active, the data may be buffered before being sent to the client, which can influence performance and timing.

Security considerations: Do not expose sensitive filesystem areas. Validate and sanitize user-supplied paths, constrain access to a base directory, and use realpath to prevent directory traversal. Be mindful that readfile can fetch remote content when allow_url_fopen is enabled, which may introduce security and performance risks. Combine with proper access controls and headers when delivering downloadable content.

Related functions and practices: For more control over file handling, alternative approaches include fopen/fgets or fread in a loop. file_get_contents reads the entire file into memory, which is less suitable for large files. When serving downloads, headers such as Content-Type and Content-Disposition are commonly used alongside readfile.