diff /etc/php5/apache2/php.ini /usr/share/doc/php5-common/examples/php.ini-recommended
3,13d2
< ;;;;;;;;;;;
< ; WARNING ;
< ;;;;;;;;;;;
< ; This is the default settings file for new PHP installations.
< ; By default, PHP installs itself with a configuration suitable for
< ; development purposes, and *NOT* for production purposes.
< ; For several security-oriented considerations that should be taken
< ; before going online with your site, please consult php.ini-recommended
< ; and http://php.net/manual/en/security.php.
<
<
57c46
< ;
---
> ;
62,65c51,110
< ; All the values in the php.ini-dist file correspond to the builtin
< ; defaults (that is, if no php.ini is used, or if you delete these lines,
< ; the builtin defaults will be identical).
<
---
> ; This is the recommended, PHP 5-style version of the php.ini-dist file.  It
> ; sets some non standard settings, that make PHP more efficient, more secure,
> ; and encourage cleaner coding.
> ;
> ; The price is that with these settings, PHP may be incompatible with some
> ; applications, and sometimes, more difficult to develop with.  Using this
> ; file is warmly recommended for production sites.  As all of the changes from
> ; the standard settings are thoroughly documented, you can go over each one,
> ; and decide whether you want to use it or not.
> ;
> ; For general information about the php.ini file, please consult the php.ini-dist
> ; file, included in your PHP distribution.
> ;
> ; This file is different from the php.ini-dist file in the fact that it features
> ; different values for several directives, in order to improve performance, while
> ; possibly breaking compatibility with the standard out-of-the-box behavior of
> ; PHP.  Please make sure you read what's different, and modify your scripts
> ; accordingly, if you decide to use this file instead.
> ;
> ; - register_long_arrays = Off     [Performance]
> ;     Disables registration of the older (and deprecated) long predefined array
> ;     variables ($HTTP_*_VARS).  Instead, use the superglobals that were
> ;     introduced in PHP 4.1.0
> ; - display_errors = Off           [Security]
> ;     With this directive set to off, errors that occur during the execution of
> ;     scripts will no longer be displayed as a part of the script output, and thus,
> ;     will no longer be exposed to remote users.  With some errors, the error message
> ;     content may expose information about your script, web server, or database
> ;     server that may be exploitable for hacking.  Production sites should have this
> ;     directive set to off.
> ; - log_errors = On                [Security]
> ;     This directive complements the above one.  Any errors that occur during the
> ;     execution of your script will be logged (typically, to your server's error log,
> ;     but can be configured in several ways).  Along with setting display_errors to off,
> ;     this setup gives you the ability to fully understand what may have gone wrong,
> ;     without exposing any sensitive information to remote users.
> ; - output_buffering = 4096        [Performance]
> ;     Set a 4KB output buffer.  Enabling output buffering typically results in less
> ;     writes, and sometimes less packets sent on the wire, which can often lead to
> ;     better performance.  The gain this directive actually yields greatly depends
> ;     on which Web server you're working with, and what kind of scripts you're using.
> ; - register_argc_argv = Off       [Performance]
> ;     Disables registration of the somewhat redundant $argv and $argc global
> ;     variables.
> ; - magic_quotes_gpc = Off         [Performance]
> ;     Input data is no longer escaped with slashes so that it can be sent into
> ;     SQL databases without further manipulation.  Instead, you should use the
> ;     function addslashes() on each input element you wish to send to a database.
> ; - variables_order = "GPCS"       [Performance]
> ;     The environment variables are not hashed into the $_ENV.  To access
> ;     environment variables, you can use getenv() instead.
> ; - error_reporting = E_ALL        [Code Cleanliness, Security(?)]
> ;     By default, PHP suppresses errors of type E_NOTICE.  These error messages
> ;     are emitted for non-critical errors, but that could be a symptom of a bigger
> ;     problem.  Most notably, this will cause error messages about the use
> ;     of uninitialized variables to be displayed.
> ; - allow_call_time_pass_reference = Off     [Code cleanliness]
> ;     It's not possible to decide to force a variable to be passed by reference
> ;     when calling a function.  The PHP 4 style to do this is by making the
> ;     function require the relevant argument by reference.
83c128
< short_open_tag = On
---
> short_open_tag = Off
89c134
< precision    =  12
---
> precision    =  14
101c146
< output_buffering = Off
---
> output_buffering = 4096
164c209
< allow_call_time_pass_reference = On
---
> allow_call_time_pass_reference = Off
169,173d213
< ; NOTE: this is considered a "broken" security measure.
< ;       Applications relying on this feature will not recieve full
< ;       support by the security team.  For more information please
< ;       see /usr/share/doc/php5-common/README.Debian.security
< ;
210,216d249
<
< ; NOTE: this is considered a "broken" security measure.
< ;       Applications relying on this feature will not recieve full
< ;       support by the security team.  For more information please
< ;       see /usr/share/doc/php5-common/README.Debian.security
< ;
<
314c347
< ;   - Show all errors except for notices and coding standards warnings
---
> ;   - Show all errors, except coding standards warnings
316c349
< error_reporting  =  E_ALL & ~E_NOTICE
---
> error_reporting  =  E_ALL
323c356
< display_errors = On
---
> display_errors = Off
333c366
< log_errors = Off
---
> log_errors = On
404c437
< variables_order = "EGPCS"
---
> variables_order = "GPCS"
415,419d447
<
< ; NOTE: applications relying on this feature will not recieve full
< ;       support by the security team.  For more information please
< ;       see /usr/share/doc/php5-common/README.Debian.security
< ;
425c453
< register_long_arrays = On
---
> register_long_arrays = Off
430c458
< register_argc_argv = On
---
> register_argc_argv = Off
446c474
< magic_quotes_gpc = On
---
> magic_quotes_gpc = Off
492c520
< ; extension_dir = "./"
---
> ;extension_dir = "./"
596d623
<
910c937
< ;session.cookie_secure =
---
> ;session.cookie_secure =
947c974
< session.gc_divisor     = 100
---
> session.gc_divisor     = 1000
967c994
< session.bug_compat_42 = 1
---
> session.bug_compat_42 = 0
1014c1041
< session.hash_bits_per_character = 4
---
> session.hash_bits_per_character = 5
1021c1048
< url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=,fieldset="
---
> url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry"
1144a1172,1174
> ; enable strict encoding detection.
> ;mbstring.strict_encoding = Off
>