How do I make a role based system to allow or deny files in an XAMPP server

I have tried using readfile() in php, after redirecting through .htaccess. but php doesn’t run the file. For example when I use something like hello_world.php with the content of

<?php
    echo "hello World!";
?>

then access it after being granted access (meaning that the php has used readfile())
it will open as if its a text document, showing me the code and not running it.
This doesn’t work with me as i want everything to run like normal, in the matter of running the file normally through Apache, and if it stops other file types from acting like this too, then its not an option i would like to go with.

i Also don’t want to download any file, i simply want to either be served the file (to be displayed on the web) or to be denied.