--- php.ini Tue Feb 27 16:06:01 2007 +++ /usr/local/share/examples/php5/php.ini-recommended Fri Sep 1 05:10:59 2006 @@ -1,16 +1,5 @@ [PHP] -;;;;;;;;;;; -; WARNING ; -;;;;;;;;;;; -; This is the default settings file for new PHP installations. -; By default, PHP installs itself with a configuration suitable for -; development purposes, and *NOT* for production purposes. -; For several security-oriented considerations that should be taken -; before going online with your site, please consult php.ini-recommended -; and http://php.net/manual/en/security.php. - - ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; @@ -54,14 +43,83 @@ ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. +; ; -; ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; -; All the values in the php.ini-dist file correspond to the builtin -; defaults (that is, if no php.ini is used, or if you delete these lines, -; the builtin defaults will be identical). +; This is the recommended, PHP 5-style version of the php.ini-dist file. It +; sets some non standard settings, that make PHP more efficient, more secure, +; and encourage cleaner coding. +; +; The price is that with these settings, PHP may be incompatible with some +; applications, and sometimes, more difficult to develop with. Using this +; file is warmly recommended for production sites. As all of the changes from +; the standard settings are thoroughly documented, you can go over each one, +; and decide whether you want to use it or not. +; +; For general information about the php.ini file, please consult the php.ini-dist +; file, included in your PHP distribution. +; +; This file is different from the php.ini-dist file in the fact that it features +; different values for several directives, in order to improve performance, while +; possibly breaking compatibility with the standard out-of-the-box behavior of +; PHP. Please make sure you read what's different, and modify your scripts +; accordingly, if you decide to use this file instead. +; +; - register_globals = Off [Security, Performance] +; Global variables are no longer registered for input data (POST, GET, cookies, +; environment and other server variables). Instead of using $foo, you must use +; you can use $_REQUEST["foo"] (includes any variable that arrives through the +; request, namely, POST, GET and cookie variables), or use one of the specific +; $_GET["foo"], $_POST["foo"], $_COOKIE["foo"] or $_FILES["foo"], depending +; on where the input originates. Also, you can look at the +; import_request_variables() function. +; Note that register_globals is going to be depracated (i.e., turned off by +; default) in the next version of PHP, because it often leads to security bugs. +; Read http://php.net/manual/en/security.registerglobals.php for further +; information. +; - register_long_arrays = Off [Performance] +; Disables registration of the older (and deprecated) long predefined array +; variables ($HTTP_*_VARS). Instead, use the superglobals that were +; introduced in PHP 4.1.0 +; - display_errors = Off [Security] +; With this directive set to off, errors that occur during the execution of +; scripts will no longer be displayed as a part of the script output, and thus, +; will no longer be exposed to remote users. With some errors, the error message +; content may expose information about your script, web server, or database +; server that may be exploitable for hacking. Production sites should have this +; directive set to off. +; - log_errors = On [Security] +; This directive complements the above one. Any errors that occur during the +; execution of your script will be logged (typically, to your server's error log, +; but can be configured in several ways). Along with setting display_errors to off, +; this setup gives you the ability to fully understand what may have gone wrong, +; without exposing any sensitive information to remote users. +; - output_buffering = 4096 [Performance] +; Set a 4KB output buffer. Enabling output buffering typically results in less +; writes, and sometimes less packets sent on the wire, which can often lead to +; better performance. The gain this directive actually yields greatly depends +; on which Web server you're working with, and what kind of scripts you're using. +; - register_argc_argv = Off [Performance] +; Disables registration of the somewhat redundant $argv and $argc global +; variables. +; - magic_quotes_gpc = Off [Performance] +; Input data is no longer escaped with slashes so that it can be sent into +; SQL databases without further manipulation. Instead, you should use the +; function addslashes() on each input element you wish to send to a database. +; - variables_order = "GPCS" [Performance] +; The environment variables are not hashed into the $_ENV. To access +; environment variables, you can use getenv() instead. +; - error_reporting = E_ALL [Code Cleanliness, Security(?)] +; By default, PHP surpresses errors of type E_NOTICE. These error messages +; are emitted for non-critical errors, but that could be a symptom of a bigger +; problem. Most notably, this will cause error messages about the use +; of uninitialized variables to be displayed. +; - allow_call_time_pass_reference = Off [Code cleanliness] +; It's not possible to decide to force a variable to be passed by reference +; when calling a function. The PHP 4 style to do this is by making the +; function require the relevant argument by reference. ;;;;;;;;;;;;;;;;;;;; @@ -80,13 +138,13 @@ ; servers which are not under your control, because short tags may not ; be supported on the target server. For portable, redistributable code, ; be sure not to use short tags. -short_open_tag = On +short_open_tag = Off ; Allow ASP-style <% %> tags. asp_tags = Off ; The number of significant digits displayed in floating point numbers. -precision = 12 +precision = 14 ; Enforce year 2000 compliance (will cause problems with non-compliant browsers) y2k_compliance = On @@ -98,7 +156,7 @@ ; setting this directive to On. If you wish to limit the size of the buffer ; to a certain size - you can use a maximum number of bytes instead of 'On', as ; a value for this directive (e.g., output_buffering=4096). -output_buffering = Off +output_buffering = 4096 ; You can redirect all of the output of your scripts to a function. For ; example, if you set output_handler to "mb_output_handler", character @@ -160,7 +218,7 @@ ; with future versions of the language (you will receive a warning each time ; you use this feature, and the argument will be passed by value instead of by ; reference). -allow_call_time_pass_reference = On +allow_call_time_pass_reference = Off ; ; Safe Mode @@ -271,7 +329,7 @@ ; intentional (e.g., using an uninitialized variable and ; relying on the fact it's automatically initialized to an ; empty string) -; E_STRICT - run-time notices, enable to have PHP suggest changes +; E_STRICT - run-time notices, enable to have PHP suggest changes ; to your code which will ensure the best interoperability ; and forward compatibility of your code ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup @@ -297,16 +355,16 @@ ; ;error_reporting = E_COMPILE_ERROR|E_ERROR|E_CORE_ERROR ; -; - Show all errors except for notices and coding standards warnings +; - Show all errors, except coding standards warnings ; -error_reporting = E_ALL & ~E_NOTICE +error_reporting = E_ALL ; Print out errors (as a part of the output). For production web sites, ; you're strongly encouraged to turn this feature off, and use error logging ; instead (see below). Keeping display_errors enabled on a production web site ; may reveal security information to end users, such as file paths on your Web ; server, your database schema or other information. -display_errors = On +display_errors = Off ; Even when display_errors is on, errors that occur during PHP's startup ; sequence are not displayed. It's strongly recommended to keep @@ -316,7 +374,7 @@ ; Log errors into a log file (server-specific log, stderr, or error_log (below)) ; As stated above, you're strongly advised to use error logging in place of ; error displaying on production web sites. -log_errors = Off +log_errors = On ; Set maximum length of log_errors. In error_log information about the source is ; added. The default is 1024 and 0 allows to not apply any maximum length at all. @@ -385,7 +443,7 @@ ; Environment and Built-in variables (G, P, C, E & S respectively, often ; referred to as EGPCS or GPC). Registration is done from left to right, newer ; values override older values. -variables_order = "EGPCS" +variables_order = "GPCS" ; Whether or not to register the EGPCS variables as global variables. You may ; want to turn this off if you don't want to clutter your scripts' global scope @@ -401,12 +459,12 @@ ; Whether or not to register the old-style input arrays, HTTP_GET_VARS ; and friends. If you're not using them, it's recommended to turn them off, ; for performance reasons. -register_long_arrays = On +register_long_arrays = Off ; This directive tells PHP whether to declare the argv&argc variables (that ; would contain the GET information). If you don't use these variables, you ; should turn it off for increased performance. -register_argc_argv = On +register_argc_argv = Off ; When enabled, the SERVER and ENV variables are created when they're first ; used (Just In Time) instead of when the script starts. If these variables @@ -422,7 +480,7 @@ ; ; Magic quotes for incoming GET/POST/Cookie data. -magic_quotes_gpc = On +magic_quotes_gpc = Off ; Magic quotes for runtime-generated data, e.g. data from SQL, from exec(), etc. magic_quotes_runtime = Off @@ -550,7 +608,7 @@ [Date] ; Defines the default timezone used by the date functions -;date.timezone = +;date.timezone = [Syslog] ; Whether or not to define the various syslog variables (e.g. $LOG_PID, @@ -720,7 +778,7 @@ ; Compatability mode with old versions of PHP 3.0. ; If on, this will cause PHP to automatically assign types to results according ; to their Sybase type, instead of treating them all as strings. This -; compatibility mode will probably not stay around forever, so try applying +; compatability mode will probably not stay around forever, so try applying ; whatever necessary changes to your code, and turn it off. sybase.compatability_mode = Off @@ -848,7 +906,7 @@ ; on each request. session.gc_probability = 1 -session.gc_divisor = 100 +session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. @@ -868,7 +926,7 @@ ; You can disable the feature and the warning separately. At this time, ; the warning is only displayed, if bug_compat_42 is enabled. -session.bug_compat_42 = 1 +session.bug_compat_42 = 0 session.bug_compat_warn = 1 ; Check HTTP Referer to invalidate externally stored URLs containing ids. @@ -915,14 +973,14 @@ ; 4 bits: 0-9, a-f ; 5 bits: 0-9, a-v ; 6 bits: 0-9, a-z, A-Z, "-", "," -session.hash_bits_per_character = 4 +session.hash_bits_per_character = 5 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; form/fieldset are special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. If you want XHTML conformity, remove the form entry. ; Note that all valid entries require a "=", even if no value follows. -url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=,fieldset=" +url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry" [MSSQL] ; Allow or prevent persistent links. @@ -1091,7 +1149,7 @@ ; a gd image. The warning will then be displayed as notices ; disabled by default ;gd.jpeg_ignore_warning = 0 - + [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding