Long answer: When you send a request(GET/POST/etc) to the .php script, the server executes it's code and sends you the result(the .html, json etc). There's this vulnerability called Local File Inclusion, where you are able to read(not execute) files from the server, including the .php ones