Secure PHP Development- P168 pps

We recommend that you install it in the same directory as you installed the Apache source.. For example, if you installed the Apache source in the /usr/local/src/httpd-2.0.16directory, t

After downloading the source distribution, extract the source in a directory by using the tar xvzf php-4.3.1tar.gzcommand We recommend that you install

it in the same directory as you installed the Apache source For example, if you installed the Apache source in the /usr/local/src/httpd-2.0.16directory, then extract PHP into the /usr/local/src directory A new subdirectory, called php-4.2.3, will be created

At this point, you have to decide how you plan to run PHP PHP can be run as

an Apache module (embedded in the server itself or as a DSO module) or as a CGI solution The CGI solution means that you will not have any performance advan-tage over regular CGI scripts with PHP scripts because a PHP interpreter will be loaded each time to process a CGI-mode PHP script

Building PHP as a CGI solution

Like Perl, PHP can be used in standalone scripts as well as embedded in Web pages

To build the PHP interpreter for CGI-mode operations, do the following:

1 As root, change to the PHP source distribution directory and run the

following:

./configure enable-discard-path with-mysql

2 Now run make && make installto compile and install the PHP inter-preter on your system

Building PHP as an Apache module

This is the preferred way of using PHP with Apache You can either store the PHP module within the Apache binary or install it as a DSO module for Apache An advantage of a DSO module is that it can be unloaded by just commenting out a configuration line in httpd.conf, thus saving some memory Here we will show you how to create PHP as a DSO module for Apache

You must have DSO support enabled in Apache before you can use PHP as a DSO module To recompile Apache with DSO support, do the following:

1 From the Apache source distribution directory, run the following

com-mand as root:

./configure prefix=/usr/local/apache enable-so

You can also add other options as necessary

2 Compile and install Apache using the make && make installcommand

After you have a DSO support–enabled Apache server, perform the following steps to create a DSO module for PHP:

1 From the PHP source distribution directory, run the following command

as root:

./configure with-apxs2=/usr/local/apache/bin/apxs \

enable-track-vars \ with-zlib \

with-mysql=/usr

Here, the with-mysqloption is set to /usrbecause MySQL RPM pack-ages install the include files in the /usr/include/mysqldirectory If your system has MySQL includes in a different location, you should use a dif-ferent directory name You can find out where MySQL includes are kept

by using the locate mysql.hcommand, which is available on most UNIX systems with the locate database feature

2 Run make && make installto compile and install the DSO version of the PHP module for Apache

3 Run the /usr/local/apache/bin/apachectl restartcommand to restart (or start) Apache

Configuring Apache for PHP

After you have installed the mod_phpmodule for Apache and configured php.ini

as discussed earlier, you are ready to configure Apache for PHP as follows:

1 Add the following line to the httpd.conffile:

AddType application/x-httpd-php php

This tells Apache that any file with a .phpextension must be treated as

an application/x-httpd-phpapplication and processed by the mod_php

module

There is no reason to use a different extension for PHP scripts For example, you can set the preceding AddType directive to AddType application/x-httpd-php html and have all your HTML pages treated as PHP script We don’t recommend using the html extension because chances are good that many of your HTML pages are not PHP scripts, and you simply do not want

to slow down your Web server by having it parse each page for PHP scripts.

2 Save the httpd.conffile and restart the Apache Web server as usual

Now you are ready to create PHP scripts for your Web site You can create PHP scripts and store them anywhere in your Web site’s document tree and Apache will automatically process them as PHP scripts

Configuring PHP by using php.ini

The PHP configuration file is called php.ini, and it is stored in the /usr/

local/lib directory by default unless you specified a different path during PHP source configuration using the configure utility When a PHP module is loaded, it reads the php.inifile The module looks for php.iniin the current working direc-tory, the path designated by the environmental variable PHPRC, and in /usr/

local/lib

If you use PHP as a CGI solution, the php.ini file is read every time a PHP CGI is run Conversely, when PHP is loaded as an Apache module, it is read once You must restart the Apache server by using the /usr/local/

apache/bin/apachectl restart command to reload any changes that you make in the php.ini file.

PHP directives in httpd.conf

With Version PHP 4, only four mod_php-specific directives, as outlined in the fol-lowing sections, are allowed in httpd.conf All other PHP directives must be in the

php.inifile

php_admin_flag

The php_flagdirective enables you to set a Boolean value (On or Off) for a config-uration parameter This directive cannot appear in directory containers or per-directory .htaccessfiles

Syntax:php_admin_flag name On | Off

Context: Server config, virtual host

php_admin_value

The php_admin_value directive enables you to set a value for a configuration parameter This directive cannot appear in directory containers or per-directory

.htaccessfiles

Syntax:php_admin_value name value

Context: Server config, virtual host

The php_flagdirective enables you to set a Boolean value (On or Off) for a config-uration parameter

Syntax:php_flag name On | Off

Context: Server config, virtual host, directory, per-directory (.htaccess) For example:

php_flag display_errors On

php_value

The php_valuedirective enables you to set a value for a configuration parameter

Syntax: php_value name value

Context: Server config, virtual host, directory, per-directory (.htaccess) For example:

php_value error_reporting 15

PHP directives in php.ini

The php.inifile has a simple directive = value structure syntax Lines consisting of

leading semicolons or lines with only whitespace are ignored Section names are enclosed in brackets You can learn about all the directives that go in php.iniat

www.php.net/manual/en/configuration.php The following sections discuss the most useful directives

auto_prepend_file

The auto_prepend_filedirective enables you to set a header document with each PHP-parsed page

Syntax:auto_prepend_file filename

The following example preload.phppage will be loaded before each PHP page

is processed (this page is a good place to establish database connections if all the pages in the site use the same database connection.):

auto_prepend_file preload.php

default_charset

The default_charsetdirective sets the default character set

Syntax:default_charset char_set

The following example sets the default character set to 8-bit UTF:

default_charset = “UTF-8”

The disable_functionsdirective enables you to disable one or more functions for security reasons

Syntax: disable_functions function_name [function_name]

You can specify a comma-delimited list of PHP functions as follows:

disable_functions = fopen, fwrite, popen

In the preceding example, the functions responsible for opening, writing file or pipes are disabled

This directive is not affected by the safe_mode directive.

display_errors

The display_errors directive enables or disables printing of error message onscreen This is recommended only for use on development systems and not for use

on production servers For production systems, you should use log_errorsalong with error_logdirectives to log error messages to files or to a syslog server so that malicious users cannot break your applications to glean information about them

Syntax:display_errors On | Off

enable_dl

The enable_dldirective enables or disables the capability to dynamically load a PHP extension

Syntax: enable_dl On | Off

Default setting:enable_dl On

error_append_string

The error_append_string directive sets the string that is appended to the error message See the error_prepend_stringdirective above

Syntax:error_append_string string

error_log

The error_logdirective sets the PHP error log path You can specify a fully quali-fied pathname of the log file, or you can specify the keyword syslogon Unix sys-tems to log using the syslog facility On Windows syssys-tems, setting this directive to

syslogwrites log entries in the Windows Event log

Syntax: error_log fqpn