Slashdot Log In
PHP 5.2.2 and 4.4.7 Released
Posted by
CowboyNeal
on Fri May 04, 2007 08:25 PM
from the hot-off-the-presses dept.
from the hot-off-the-presses dept.
daeg writes "PHP 5.2.2 and 4.4.7 have been released with a plethora of security updates. Many of the security notifications come from the Month of PHP Bugs effort, and range from double freed memory to bugs in functions that allow attackers to enable register_globals, to memory corruption with unserialize(), to input validation flaws that allow e-mail header injections, with an unhealthy sprinkling of other bugs and flaws fixed. All administrators that run any version of PHP are encouraged to update immediately."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
I want to see someone claim again (Score:5, Insightful)
Now if only could PHP also fix their performance and inconsistencies..
Re: (Score:3, Interesting)
Now if only could PHP also fix their performance and inconsistencies..
There's nothing "gaping". All the "month of bugs" were non-critical stuff pumped up by Esser for whatever reason I don't know. For example, there were a number of bugs that required the attacker to be able to supply their own code. If the attacker can su
Re: (Score:3, Funny)
Right. PHP's the fastest language out there, as proven in this test [debian.org].
Re: (Score:2)
Perl is usually better [debian.org] as well, as is Python, Tcl, etc.
In PHP's defense, how does performance compare once some sort of accelerator is involved? Are those fancy output caching engines or do they actually precompile/cache the code or something like that?
Re:I want to see someone claim again (Score:5, Interesting)
When you run a PHP file, there are two stages of execution:
[build a parse tree from the source and output bytecodes] [interpret the bytecodes]
The accelerators cache the bytecodes, so next time they are loaded (usually from RAM) and interpreted directly.
However compare with what you get with the CLR by default:
[a compiler builds the parse tree and outputs bytecodes] [opcodes are compiled to machine code] [natively run machine code linked to a runtime library]
You basically never ever repeat the first step more than once there, and in some cases the second. And running as native code is hella faster. A big problem with PHP is it abuses string hashes and fails to do early binding where appropriate (indexed serial arrays, class objects and methods etc.).
So everything you reference in PHP requires a bunch of hash lookups. It's terrible.
Parent
Re: (Score:2)
Or perhaps even build an interpreter into the web server itself (mod_mono).
Spped problems eliminated.
Re: (Score:3, Insightful)
Heck you can make a bash script output your website for you. Or even QBASIC.
Re:I want to see someone claim again (Score:5, Informative)
There are plenty of good criticisms for PHP (and every other language), but performance is only a factor in PHP web apps when the programmers do really stupid things.
Parent
Re: (Score:2)
What's also important is that PHP is meant to be parallelized, which lets it scale better to higher traffic. The l
Re: (Score:2)
care to site benchmarks? I saw one that had zend framework doing horribly as well. They were using version 0.4 beta. They're up to
Re: (Score:2)
Re:I want to see someone claim again (Score:5, Informative)
You're comparing two completely differnet language types. You might as well compare Java and C++.
Compared to other interpreted (e.g. parse tree is built on the fly rather than by a compiler) languages like Python or Ruby, PHP is about average.
Compare PHP to the CLR (or Mono) or to the JRE, and PHP is going to be way slower.
But calling PHP slow because of some benchmark is just bull. Yes, Java or
The Wikimedia Foundation runs Wikipedia (the 10th most popular website in the world) with PHP and 123 commodity PC servers. What does that prove? It proves that application design and system architecture is FAR more important than what platform you choose. You can run benchmarks all day long, but that doesn't change the fact that Wikipedia does far more with far less than most websites out there - and they do it with PHP.
I serve over 10 million pageviews a month on WS Network [wikinote.com] using PHP, MySQL, and a virtual server with 50MB of memory, a fraction of a 2.4GHz P4, and 100MB of swap. My informal load testing indicates that I could handle as many as 30 pageviews per second (80 million per month) with my current hardware and DB setup.
Maybe I could do more with J2EE or ASP.NET (or, perhaps I could do far less - ASP.NET and J2EE aren't as easy on memory as PHP for small apps). But the fact is that I am doing a hell of a lot already considering the very limited hardware I'm running on.
PHP code execution performance is not, and has never been, a major issue in my experience. It's the same way with Python, Perl, Ruby, and any other "scripting" language. The fact is, you're not going to write an H.264 codec or a PS3 game in Python. But many, many applications are not constrained by CPU performance. 8-core servers are now cheap. 16-core servers will be soon. Changing your language might give you 10x better performance. But architecture and algorithm improvements will probably get you much, much more.
"Performance isn't a problem until it's a problem."
Parent
Re:I want to see someone claim again (Score:4, Interesting)
Throwing more hardware at a problem will solve anything \o/
I'm running a service which was originally PHP on a throwout box in the corner of my bedroom -- after a few months, the service was so popular the box was in a state of slashdottedness 24/7. I then moved to a shared host, where it ran happily for about a year, until it got so big it started breaking their uber-servers too. I have now rewritten it in python, and moved back to hosting it myself :P
Parent
Comparing mono with C# is unfair (Score:2, Interesting)
Re:I want to see someone claim again (Score:5, Interesting)
PHP enjoys overwhelming popularity in shared-hosting environments, where you put a lot of users on one server, and the users supply the code, but you don't really trust the users. You don't want them to compromise other users' reliability, or break your server, or do anything very interesting... but you still have to let them run their code because that's what the service is. So PHP comes with all sorts of features to facilitate this... "safe mode" and the like. But if there are security issues all through PHP that poke holes in this security model, then you find yourself in a microsoft-esque situation where the security isn't real at all, and you're screwed. Not so pleasant.
Parent
Re:I want to see someone claim again (Score:4, Informative)
So how worried you should be about PHP security comes down to whether you'll be running your own code you trust, or hosting someone else's code you don't trust.
Parent
Re: (Score:2)
The only way to get this kind of security is to rely on the operating system to provide it for you; this is done by running PHP interpreters belonging to different security contexts as seperate users.
With such a setup, the worst the user can do is screw up their own files (boo hoo!).
Re: (Score:2)
Re: (Score:2)
That way, all the PHP code is executing as the individual web hosting user, and not as the global apache user. Thus:
A bug in one user's site compromises their own account, but cannot mess with any of the other accounts.
You cant stop users running buggy code, and its their own fault if they do. But you certainly should keep that code in a sandbox.
Re: (Score:2)
I think the month of bugs helps consumers in the long term, but its certainly a bitch for the vendor to get flooded with tons of holes at once.
Re: (Score:2)
Besides, if Zend added the code to begin with how does one seperate what is going to go away from what is useful? Are they supposed to read minds? Seems very much like random windows apis that disappear or change.
Re: (Score:2)
Care to provide examples of either?
Re: (Score:3, Funny)
Re: (Score:3)
Re: (Score:2)
Examples of PHP inconsistency and performance (Score:5, Informative)
Inconsistent function naming (underscores):
substr_compare() vs.
strcmp()
More inconsistent function naming (verb location):
file_get_contents() vs.
get_html_translation_table()
Even within the same extension:
imagesetstyle() vs.
imagecolorset()
Flipped haystack and needle:
strpos(haystack, needle) vs.
in_array(needle, haystack)
Speed:
Scutigena Computer Language Performance Comparison [sourceforge.net] (see graphs)
There used to be another site that you could compare one language's speed relative to another that also showed PHP as one of the slowest. I can't seem to find it now, though. Also PHP5 might compare a bit more favourably, but this is all I could find after a quick Google search. Perhaps more importantly, PHP drags the speed of other things down (like Apache), since even though the core is supposedly thread-safe, nobody seems to know which extensions are and aren't, so eg. Apache needs to be run in prefork mpm instead of using a threaded mpm.
I think PHP is overall a fairly decent language; I've used it for many years with great success. But it does have major problems, and it would be nice for them to get fixed instead of pushed aside. (I read some minutes from a PHP 6 meeting a while ago where they touched on the issue of consistency, and the PHP Group decided that it wasn't important enough to fix. It's really annoying to me to need a PHP-aware IDE or a manual always handy to program in a language because the arguments and function names are so non-uniform.)
Parent
Re: (Score:2, Interesting)
Yep, there still is. I think you are thinking about this one:
Computer Language Benchmarks Game [debian.org]>
That site features 19 programs implemented in 33 languages. Each program stresses something. You can see relative execution times and memory use, and it lets you pit one specific language and another and see how they compare.
Yes, PHP loses in pretty much every perfo
Re:Examples of PHP inconsistency and performance (Score:5, Insightful)
This is my main beef with PHP. They have their head in the sand with regards to server configuration.
Case in point: the company I work for sells PHP-based service center and reservations systems to large companies. These companies generally have windows-based server infrastructures, so we have to deploy on windows/IIS. If you look at the suggested configuration for PHP on IIS in the PHP manual, you'll find this page [php.net], which explains regular CGI and ISAPI (multi-threaded) configurations. What the manual doesn't tell you is that neither of these configurations actually work in production environments. Regular CGI configurations are too slow (on windows), and ISAPI is too unreliable (customers that deployed with ISAPI configurations suffered daily server hangs).
The only viable configuration for production IIS servers, as it turns out, is FastCGI, which is not documented in PHP's manual section on IIS configuration. Their documentation actively misinforms people on how to configure PHP. That's bad.
Parent
Bad release practices (Score:5, Insightful)
See, for example, the 4.6.6 release notes [php.net]:
Thank god Python doesn't do that. At least they keep all the big changes to individual versions!
Re: (Score:2)
Re:Bad release practices (Score:5, Informative)
Firefox does the same thing too, except they end up stepping on extension authors feet when they increment the third version number! That's why they introduced a fourth number 0.0.0.x for memory leak / security fixes. But Firefox has the luxury of an auto-update system: something PHP doesn't have. It is in both sysadmin's and PHP's developer's best interests to not be releasing new versions every other week.
Parent
Re: (Score:2)
- X means "functionality improvements" (relative to X-1)
- Y means "bugs fixed" (relative to X.Y-1)
- Z means "security fixes" (relative to X.Y.Z-1)
?Re:Bad release practices (Score:4, Informative)
Parent
Re: (Score:2)
Re: (Score:3, Informative)
I also recommend reading over PEP 0008 [python.org], the "standard" coding structure for the
Re: (Score:2)
I used to fall on the spaces side until I realized how iritating it is to respace things when you move down an indentation level and you're not using an IDE.
I've been a staunch tab supporter ever since.
It's not just that, either. If one uses tabs, then anyone else who has to edit it can set the tab size to whatever they wish. If Paul has a super widescreen monitor and wants his tab size set to 16 characters, more power to him! If George has a super small monitor and
Re: (Score:2)
The Tab key is not a shortcut for pressing space 8 times, damnit!
Re: (Score:2)
Re: (Score:2)
Hate to whine, but... (Score:2)
I failed to include support for curl when 5.2.1 came out and just spent close to an hour waiting for PHP 5.2.1 to compile, yesterday. Guess it's time to run ./configure again.
Most of these bugs are completely preventable (Score:2, Insightful)
"double freed memory to bugs in functions that allow attackers to enable register_globals, to memory corruption with unserialize()"
The authors of php should use valgrind, and with a few test cases, could virtually eliminate memory errors.
Memory errors have been around for so long that there are numerous tools for dealing with them, many of them free. I know
Re:You must be mistaken. (Score:5, Insightful)
I'm a PHP developer. I love PHP because I haven't come across anything that I can not do with it yet. Does that mean it's the best programming language ZOMG 3V3R! No. PHP is a pretty good general purpose web scripting language. Like all the other languages out there, it has bugs or features that haven't been implemented or thought of yet, and that's why there are version numbers.
PHP does suffer some of the same issues that C++ has suffered in the past, and they are due to the fundamental ideas of the project. PHP doesn't have a framework for you to do everything. I guess that mostly comes up with ASP and probably Ruby, but I'm a little under read on Ruby. Much like the C++ vs. Java debate, C++ makes you do things yourself (or at least you need to know about the community projects that make life easier... like smart pointers and the like). That's pretty much the same with PHP. You have the base functions, and there are extensions you can get to help, but MVC and other parts of frameworks are left for you to decide what you want or need for your project.
So, with that in mind, security is also left up to the developer. PHP 5.2.x has made a lot of great strides in helping out by introducing the Filter extension and others. If people do not filter/escape the input/output from their pages, they're just opening up a can of worms. I'm a firm believer in saying it's easier to filter yourself than undo a filter that the system did for you automatically.
PHP has its issues, but I don't think it would be as popular as it is if PHP didn't serve a purpose and do it somewhat well.
Parent
Re: (Score:3, Informative)
For multi-threading, install a shared-memory cache, like apc, eAccelerator, or mmcache -- or use an in-memory table in your RDBMS. Now, you can spawn background tasks and monitor their progress or receive return values through the cache. You can even start a task as a server and keep it running indefinitely with set_time_limit(). I do plenty of unicode apps as UTF-8, and haven't had problems yet. If you're talking about UCS-2, then you have a good case. It's in development [php.net], but it's for PHP 6. Honestl
Re: (Score:2)
Are you implying that those two items are mutually exclusive? I would be very impressed with any software project beyond "Hello World" that has never had a security problem. Having said that, a lot of the negative reputation is because people who haven't written more than 10 lines of PHP code think that phpBB and phpNuke demonstrate the only possible way to write PHP. Any language that lets you ru
Re: (Score:2)
http://secunia.com/product/3571/?task=advisories [secunia.com]
So yes, while PHP's advisories are about 10 orders of magnatude more numerous than Tomcat's, it still "bug that would let a remote user execute code or change configuration settings or read files or doing a double-free or any of that kind of thing".
And trust me, it's just as easy to create fragile code in Java that can open your server like goatse as it is in
Re: (Score:3, Insightful)
Unfortunately, mod_php is still more programmer and administrator friendly than mod_perl, which probably explains why it has a higher usage rate.
Try Fastcgi (Score:2)
With fastcgi you can use perl, python, ruby, C++ or whatever - just like yo
Re: (Score:2)
Re: (Score:2)
The mod_perl stuff tries to do the persistent DB stuff but in a kludgy untidy way that has a lot more gotchas. Same for PHP's mysql_pconnect. Go see people say "turn off persistent DB connections" in one answer and then "turn on persistent DB connections" in another answer
I've tried mod_perl, FastCGI is cleaner,
Re: (Score:3, Insightful)
PHP is getting better. They are cleaning up security issues, and providing more and more of a solid core of capabilities. I just wish that the users were more excited about these developments. I can't understand why so many continue to develop in PHP4. Every change and step forward gets a mixed response.
Personally, I'm all for breaking conventions if it will result in making PHP a better language. I wish that they would bite the bullet and rename all the functions to follow a consistent style in PHP6. T