Well Formed Mind

Introduction  ¶ PHP is a powerful language and the interpreter, whether included in a web server as a module or executed as a separate  CGI  binary, is able to access files, execute commands and open network connections on the server. These properties make anything run on a web server insecure by default. PHP is designed specifically to be a more secure language for writing  CGI  programs than Perl or C, and with correct selection of compile-time and runtime configuration options, and proper coding practices, it can give you exactly the combination of freedom and security you need. As there are many different ways of utilizing PHP, there are many configuration options controlling its behaviour. A large selection of options guarantees you can use PHP for a lot of purposes, but it also means there are combinations of these options and server configurations that result in an insecure setup. The configuration flexibility of PHP is equally rivalled by the cod...

DTrace Dynamic Tracing   Introduction to PHP and DTrace Using PHP and DTrace Using SystemTap with PHP DTrace Static Probes

Garbage Collection   Reference Counting Basics Collecting Cycles Performance Considerations This section explains the merits of the new Garbage Collection (also known as GC) mechanism that is part of PHP 5.3.

Using PHP from the command line   Table of Contents   Introduction Differences to other SAPIs Options Usage I/O streams Interactive shell Built-in web server INI settings

Safe Mode   Security and Safe Mode Functions restricted/disabled by safe mode The PHP safe mode is an attempt to solve the shared-server security problem. It is architecturally incorrect to try to solve this problem at the PHP level, but since the alternatives at the web server and OS levels aren't very realistic, many people, especially ISP's, use safe mode for now. Warning This feature has been  DEPRECATED  as of PHP 5.3.0 and  REMOVED  as of PHP 5.4.0. Changelog for  safe mode Version Description 5.4.0 Removed from PHP, and generates a fatal  E_CORE_ERROR  level error when enabled. 5.3.0 Deprecated, and  E_DEPRECATED  errors were added.

Persistent Database Connections  ¶ Persistent connections are links that do not close when the execution of your script ends. When a persistent connection is requested, PHP checks if there's already an identical persistent connection (that remained open from earlier) - and if it exists, it uses it. If it does not exist, it creates the link. An 'identical' connection is a connection that was opened to the same host, with the same username and the same password (where applicable). People who aren't thoroughly familiar with the way web servers work and distribute the load may mistake persistent connects for what they're not. In particular, they do  not  give you an ability to open 'user sessions' on the same link, they do  not  give you an ability to build up a transaction efficiently, and they don't do a whole lot of other things. In fact, to be extremely clear about the subject, persistent connections don't give you  any functionality that wasn...

Connection handling   Internally in PHP a connection status is maintained. There are 4 possible states: 0 - NORMAL 1 - ABORTED 2 - TIMEOUT 3 - ABORTED and TIMEOUT When a PHP script is running normally, the NORMAL state is active. If the remote client disconnects, the ABORTED state flag is turned on. A remote client disconnect is usually caused by the user hitting his STOP button. If the PHP-imposed time limit (see  set_time_limit() ) is hit, the TIMEOUT state flag is turned on. You can decide whether or not you want a client disconnect to cause your script to be aborted. Sometimes it is handy to always have your scripts run to completion even if there is no remote browser receiving the output. The default behaviour is however for your script to be aborted when the remote client disconnects. This behaviour can be set via the ignore_user_abort  php.ini  directive as well as through the corresponding  php_value ignore_user_abort  Apache  htt...

Using remote files  ¶ As long as  allow_url_fopen  is enabled in  php.ini , you can use  HTTP  and  FTP  URLs with most of the functions that take a filename as a parameter. In addition, URLs can be used with the  include ,  include_once ,  require  and require_once  statements (since PHP 5.2.0,  allow_url_include  must be enabled for these). See  Supported Protocols and Wrappers  for more information about the protocols supported by PHP. For example, you can use this to open a file on a remote web server, parse the output for the data you want, and then use that data in a database query, or simply to output it in a style matching the rest of your website. Example #1 Getting the title of a remote page $file  =  fopen  ( "http://www.example.com/" ,  "r" ); if (! $file ) {     echo  "Unable to open remote file.\n" ; ...

Handling file uploads   POST method uploads Error Messages Explained Common Pitfalls Uploading multiple files PUT method support See Also

Dealing with XForms   » XForms  defines a variation on traditional webforms which allows them to be used on a wider variety of platforms and browsers or even non-traditional media such as PDF documents. The first key difference in XForms is how the form is sent to the client.  »  XForms for HTML Authors  contains a detailed description of how to create XForms, for the purpose of this tutorial we'll only be looking at a simple example. Example #1 A simple XForms search form Search Find Go The above form displays a text input box (named  q ), and a submit button. When the submit button is clicked, the form will be sent to the page referred to by  action . Here's where it starts to look different from your web application's point of view. In a normal HTML form, the data would be sent as  application/x-www-form-urlencoded , in the XForms world however, this information is sent as  XML  formatte...

Sessions   Session support in PHP consists of a way to preserve certain data across subsequent accesses. This enables you to build more customized applications and increase the appeal of your web site. All information is in the  Session reference  section.

Cookies   PHP transparently supports  HTTP  cookies. Cookies are a mechanism for storing data in the remote browser and thus tracking or identifying return users. You can set cookies using the  setcookie()  or  setrawcookie()  function. Cookies are part of the  HTTP  header, so  setcookie()  must be called before any output is sent to the browser. This is the same limitation that  header()  has. You can use the  output buffering functions  to delay the script output until you have decided whether or not to set any cookies or send any headers. Any cookies sent to server from the client will automatically be included into a  $_COOKIE  auto-global array if  variables_order  contains "C". If you wish to assign multiple values to a single cookie, just add  []  to the cookie name. On older PHP systems (5.3 or earlier),  register_globals  may be enabled, which may cause un...

HTTP authentication with PHP  ¶ It is possible to use the  header()  function to send an  "Authentication Required"  message to the client browser causing it to pop up a Username/Password input window. Once the user has filled in a username and a password, the URL containing the PHP script will be called again with the  predefined variables   PHP_AUTH_USER ,  PHP_AUTH_PW , and  AUTH_TYPE  set to the user name, password and authentication type respectively. These predefined variables are found in the  $_SERVER  array. Both "Basic" and "Digest" (since PHP 5.1.0) authentication methods are supported. See the  header()  function for more information. An example script fragment which would force client authentication on a page is as follows: Example #1 Basic HTTP Authentication example if (!isset( $_SERVER [ 'PHP_AUTH_USER' ])) {      header ( 'WWW-Authenticate: Basic r...