@leihyunzhang said:
But why should the file be executed?
Well, that depends on what the file is.
PHP is a server-side scripting language. If your server supports it, the code it contains is executed and the output returned to the user agent that requested it.
Same with things like JSP.
If you request a plain HTML file, nothing is executed as the file isn’t processed - however there are exceptions such as embedded javascript and SSI, but this makes it a bit more complex.
Isn’t it supposed to be something like an image? Why should the server run it?
Well, if it is an image the server wont run it - but having a .php extension means it is likely that the server will attempt to pre-process it before rendering its output. This obviously depends on how the server is configured but for a starting point CTF, I would assume that if it says it processes PHP, it processes PHP.