PHP 5.2.2 and 4.4.7 Released 122
daeg writes "PHP 5.2.2 and 4.4.7 have been released with a plethora of security updates. Many of the security notifications come from the Month of PHP Bugs effort, and range from double freed memory to bugs in functions that allow attackers to enable register_globals, to memory corruption with unserialize(), to input validation flaws that allow e-mail header injections, with an unhealthy sprinkling of other bugs and flaws fixed. All administrators that run any version of PHP are encouraged to update immediately."
I want to see someone claim again (Score:5, Insightful)
Now if only could PHP also fix their performance and inconsistencies..
Re: (Score:3, Interesting)
Now if only could PHP also fix their performance and inconsistencies..
There's nothing "gaping". All the "month of bugs" were non-critical stuff pumped up by Esser for whatever reason I don't know. For example, there were a number of bugs that required the attacker to be able to supply their own code. If the attacker can su
Re: (Score:3, Funny)
Right. PHP's the fastest language out there, as proven in this test [debian.org].
Re: (Score:2)
Perl is usually better [debian.org] as well, as is Python, Tcl, etc.
In PHP's defense, how does performance compare once some sort of accelerator is involved? Are those fancy output caching engines or do they actually precompile/cache the code or something like that?
Re:I want to see someone claim again (Score:5, Interesting)
When you run a PHP file, there are two stages of execution:
[build a parse tree from the source and output bytecodes] [interpret the bytecodes]
The accelerators cache the bytecodes, so next time they are loaded (usually from RAM) and interpreted directly.
However compare with what you get with the CLR by default:
[a compiler builds the parse tree and outputs bytecodes] [opcodes are compiled to machine code] [natively run machine code linked to a runtime library]
You basically never ever repeat the first step more than once there, and in some cases the second. And running as native code is hella faster. A big problem with PHP is it abuses string hashes and fails to do early binding where appropriate (indexed serial arrays, class objects and methods etc.).
So everything you reference in PHP requires a bunch of hash lookups. It's terrible.
Re: (Score:1, Flamebait)
If you tried using Mono/C# in a real world situation you'd find that it would be horrible because it would run as a CGI. The initialization for it would kill the server.
I notice that none of the tests were remotely related to a web page as well.
How the hell is Mandelbrot relevant?
Re: (Score:2)
Or perhaps even build an interpreter into the web server itself (mod_mono).
Spped problems eliminated.
Re: (Score:2)
mod_mono actually just sends the request to a mod_mono_server, which is a special version of the Mono ASP.NET web server that has a special interface.
mod_mono's advantage is the ability to manage the mod_mono_server processes for you, while using standard HTTP proxying would require the user to start the process on their own.
It is pretty similar to server-side Java.
FastCGI support [mono-project.com] for Mono would be nice so that non-Apache servers cou
Re: (Score:1, Troll)
I don't think there's many high-perormance websites out there that work using forking (standard CGI). In fact, IIRC Mono doesn't even support working as CGI, and I'm pretty sure Java doesn't as well. They only support running via an external process server (much like Java), e.g. via FastCGI, local proxying, or a special webserver/process s
Re: (Score:3, Insightful)
Heck you can make a bash script output your website for you. Or even QBASIC.
Re: (Score:2)
Re: (Score:2)
It wont work or you wont get support if you bork your system doing it?
Re: (Score:2)
CGI is unsuitable for any high-performance website, anyway.
Re:I want to see someone claim again (Score:5, Informative)
There are plenty of good criticisms for PHP (and every other language), but performance is only a factor in PHP web apps when the programmers do really stupid things.
Re: (Score:1, Insightful)
What you're saying: PHP is only good for gluing your DB to your HTML, straight procedural code. But that was true
Re: (Score:2)
care to site benchmarks? I saw one that had zend framework doing horribly as well. They were using version 0.4 beta. They're up to
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
What's also important is that PHP is meant to be parallelized, which lets it scale better to higher traffic. The l
Re:I want to see someone claim again (Score:5, Informative)
You're comparing two completely differnet language types. You might as well compare Java and C++.
Compared to other interpreted (e.g. parse tree is built on the fly rather than by a compiler) languages like Python or Ruby, PHP is about average.
Compare PHP to the CLR (or Mono) or to the JRE, and PHP is going to be way slower.
But calling PHP slow because of some benchmark is just bull. Yes, Java or
The Wikimedia Foundation runs Wikipedia (the 10th most popular website in the world) with PHP and 123 commodity PC servers. What does that prove? It proves that application design and system architecture is FAR more important than what platform you choose. You can run benchmarks all day long, but that doesn't change the fact that Wikipedia does far more with far less than most websites out there - and they do it with PHP.
I serve over 10 million pageviews a month on WS Network [wikinote.com] using PHP, MySQL, and a virtual server with 50MB of memory, a fraction of a 2.4GHz P4, and 100MB of swap. My informal load testing indicates that I could handle as many as 30 pageviews per second (80 million per month) with my current hardware and DB setup.
Maybe I could do more with J2EE or ASP.NET (or, perhaps I could do far less - ASP.NET and J2EE aren't as easy on memory as PHP for small apps). But the fact is that I am doing a hell of a lot already considering the very limited hardware I'm running on.
PHP code execution performance is not, and has never been, a major issue in my experience. It's the same way with Python, Perl, Ruby, and any other "scripting" language. The fact is, you're not going to write an H.264 codec or a PS3 game in Python. But many, many applications are not constrained by CPU performance. 8-core servers are now cheap. 16-core servers will be soon. Changing your language might give you 10x better performance. But architecture and algorithm improvements will probably get you much, much more.
"Performance isn't a problem until it's a problem."
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
I'm not against monetization, but if I don't understand what the provider is getting out of it, it makes me uneasy about using the service even if I like the service.
Re:I want to see someone claim again (Score:4, Interesting)
Throwing more hardware at a problem will solve anything \o/
I'm running a service which was originally PHP on a throwout box in the corner of my bedroom -- after a few months, the service was so popular the box was in a state of slashdottedness 24/7. I then moved to a shared host, where it ran happily for about a year, until it got so big it started breaking their uber-servers too. I have now rewritten it in python, and moved back to hosting it myself :P
Comparing mono with C# is unfair (Score:2, Interesting)
Re:I want to see someone claim again (Score:5, Interesting)
PHP enjoys overwhelming popularity in shared-hosting environments, where you put a lot of users on one server, and the users supply the code, but you don't really trust the users. You don't want them to compromise other users' reliability, or break your server, or do anything very interesting... but you still have to let them run their code because that's what the service is. So PHP comes with all sorts of features to facilitate this... "safe mode" and the like. But if there are security issues all through PHP that poke holes in this security model, then you find yourself in a microsoft-esque situation where the security isn't real at all, and you're screwed. Not so pleasant.
Re:I want to see someone claim again (Score:4, Informative)
So how worried you should be about PHP security comes down to whether you'll be running your own code you trust, or hosting someone else's code you don't trust.
Re: (Score:2)
The only way to get this kind of security is to rely on the operating system to provide it for you; this is done by running PHP interpreters belonging to different security contexts as seperate users.
With such a setup, the worst the user can do is screw up their own files (boo hoo!).
Re: (Score:2)
Re: (Score:2)
That way, all the PHP code is executing as the individual web hosting user, and not as the global apache user. Thus:
A bug in one user's site compromises their own account, but cannot mess with any of the other accounts.
You cant stop users running buggy code, and its their own fault if they do. But you certainly should keep that code in a sandbox.
Re: (Score:2)
I'm using it, it works just fine...
Even supports eaccelerator too.
Re: (Score:1)
It's not that simple. In the case of web hosts with the open_basedir restriction in effect, you can't *open() or system() anything outside the basedir. It's a pretty effective jail. Here's an excerpt from the open_basedir documentation [php.net]:
Re: (Score:2)
I think the month of bugs helps consumers in the long term, but its certainly a bitch for the vendor to get flooded with tons of holes at once.
Re: (Score:1)
I've never had a script break with version jumps (including 4 to 5) because I write good proper code.
Some older crap wont work on PHP 5 but why would you want to run crap?
Re: (Score:2)
Besides, if Zend added the code to begin with how does one seperate what is going to go away from what is useful? Are they supposed to read minds? Seems very much like random windows apis that disappear or change.
Re: (Score:2)
Care to provide examples of either?
Re: (Score:3, Funny)
Re: (Score:3)
Re: (Score:2)
Examples of PHP inconsistency and performance (Score:5, Informative)
Inconsistent function naming (underscores):
substr_compare() vs.
strcmp()
More inconsistent function naming (verb location):
file_get_contents() vs.
get_html_translation_table()
Even within the same extension:
imagesetstyle() vs.
imagecolorset()
Flipped haystack and needle:
strpos(haystack, needle) vs.
in_array(needle, haystack)
Speed:
Scutigena Computer Language Performance Comparison [sourceforge.net] (see graphs)
There used to be another site that you could compare one language's speed relative to another that also showed PHP as one of the slowest. I can't seem to find it now, though. Also PHP5 might compare a bit more favourably, but this is all I could find after a quick Google search. Perhaps more importantly, PHP drags the speed of other things down (like Apache), since even though the core is supposedly thread-safe, nobody seems to know which extensions are and aren't, so eg. Apache needs to be run in prefork mpm instead of using a threaded mpm.
I think PHP is overall a fairly decent language; I've used it for many years with great success. But it does have major problems, and it would be nice for them to get fixed instead of pushed aside. (I read some minutes from a PHP 6 meeting a while ago where they touched on the issue of consistency, and the PHP Group decided that it wasn't important enough to fix. It's really annoying to me to need a PHP-aware IDE or a manual always handy to program in a language because the arguments and function names are so non-uniform.)
Re: (Score:2, Interesting)
Yep, there still is. I think you are thinking about this one:
Computer Language Benchmarks Game [debian.org]>
That site features 19 programs implemented in 33 languages. Each program stresses something. You can see relative execution times and memory use, and it lets you pit one specific language and another and see how they compare.
Yes, PHP loses in pretty much every perfo
Re:Examples of PHP inconsistency and performance (Score:5, Insightful)
This is my main beef with PHP. They have their head in the sand with regards to server configuration.
Case in point: the company I work for sells PHP-based service center and reservations systems to large companies. These companies generally have windows-based server infrastructures, so we have to deploy on windows/IIS. If you look at the suggested configuration for PHP on IIS in the PHP manual, you'll find this page [php.net], which explains regular CGI and ISAPI (multi-threaded) configurations. What the manual doesn't tell you is that neither of these configurations actually work in production environments. Regular CGI configurations are too slow (on windows), and ISAPI is too unreliable (customers that deployed with ISAPI configurations suffered daily server hangs).
The only viable configuration for production IIS servers, as it turns out, is FastCGI, which is not documented in PHP's manual section on IIS configuration. Their documentation actively misinforms people on how to configure PHP. That's bad.
Re: (Score:1)
As far as the thread-safe issue goes, [IMO] it has always been better to run Apache under a process-based MPM, as it's:
1) more secure, isolating
2) more stable
The common misconception of the performance penalty arises more from the lack of any further MPM configuration to the specific task and system.
Re: (Score:2)
Oh, you forgot:
5,343 built-in functions [php.net], assuming all the standard modules are installed. By comparison Python has 71 [python.org]. In other words, you have to keep track of about 75 times the number of name collisions when dealing with PHP versus Python.
This could be almost instantly fixed if they'd add namespaces to PHP, but that keeps getting shot down.
Re: (Score:2)
Re: (Score:2)
Yep. They were removed from 5.0.0 beta 2 [php.net] for various reasons [sitepoint.com].
Re: (Score:1)
Bad release practices (Score:5, Insightful)
See, for example, the 4.6.6 release notes [php.net]:
Thank god Python doesn't do that. At least they keep all the big changes to individual versions!
Re: (Score:1, Insightful)
If you use register_globals, you deserve all bugs that hit you. Period.
Re: (Score:1)
Or maybe not?
Re: (Score:1)
Re: (Score:2)
$msg = preg_replace('/register_globals/', 'php', $msg);
Re: (Score:1)
msg=msg.replace('register_globals, 'php')
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re:Bad release practices (Score:5, Informative)
Firefox does the same thing too, except they end up stepping on extension authors feet when they increment the third version number! That's why they introduced a fourth number 0.0.0.x for memory leak / security fixes. But Firefox has the luxury of an auto-update system: something PHP doesn't have. It is in both sysadmin's and PHP's developer's best interests to not be releasing new versions every other week.
Re: (Score:2)
- X means "functionality improvements" (relative to X-1)
- Y means "bugs fixed" (relative to X.Y-1)
- Z means "security fixes" (relative to X.Y.Z-1)
?Re: (Score:2)
Re: (Score:2)
Re:Bad release practices (Score:4, Informative)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Informative)
I also recommend reading over PEP 0008 [python.org], the "standard" coding structure for the
Re: (Score:2)
I used to fall on the spaces side until I realized how iritating it is to respace things when you move down an indentation level and you're not using an IDE.
I've been a staunch tab supporter ever since.
It's not just that, either. If one uses tabs, then anyone else who has to edit it can set the tab size to whatever they wish. If Paul has a super widescreen monitor and wants his tab size set to 16 characters, more power to him! If George has a super small monitor and
Re: (Score:2)
The Tab key is not a shortcut for pressing space 8 times, damnit!
Re: (Score:2)
some_call(arg1, arg2,
arg3, arg4)
but moved over, obviously. If you used tabs in there instead of spaces, and someone changes their tab size, your code instantly becomes completely unreadable.
Re: (Score:2)
(I haven't learned Python yet, so I'm just guessing)
Re: (Score:2)
Tabs should be used for the initial indentation. Once you reach the indentation level that you want, use spaces to line things up (the clue is in the name... you can't "line things up" by using a spacing character that has a variable length... so don't!)
Re: (Score:1)
To answer your question, though, Python doesn't "like" mixing tabs and spaces. It's also nice that almost all Python code follows "PEP 8". When interviewing for Python-heavy positions, for instance, I can ask if they know what PEP 8 syntax is. If they've never even heard of it, they aren't really interested in the language as far as I'm concerned. I wasn't a fan of spaces, either, until I switched into Python as my language o
Hate to whine, but... (Score:2)
I failed to include support for curl when 5.2.1 came out and just spent close to an hour waiting for PHP 5.2.1 to compile, yesterday. Guess it's time to run ./configure again.
Re:You must be mistaken. (Score:5, Insightful)
I'm a PHP developer. I love PHP because I haven't come across anything that I can not do with it yet. Does that mean it's the best programming language ZOMG 3V3R! No. PHP is a pretty good general purpose web scripting language. Like all the other languages out there, it has bugs or features that haven't been implemented or thought of yet, and that's why there are version numbers.
PHP does suffer some of the same issues that C++ has suffered in the past, and they are due to the fundamental ideas of the project. PHP doesn't have a framework for you to do everything. I guess that mostly comes up with ASP and probably Ruby, but I'm a little under read on Ruby. Much like the C++ vs. Java debate, C++ makes you do things yourself (or at least you need to know about the community projects that make life easier... like smart pointers and the like). That's pretty much the same with PHP. You have the base functions, and there are extensions you can get to help, but MVC and other parts of frameworks are left for you to decide what you want or need for your project.
So, with that in mind, security is also left up to the developer. PHP 5.2.x has made a lot of great strides in helping out by introducing the Filter extension and others. If people do not filter/escape the input/output from their pages, they're just opening up a can of worms. I'm a firm believer in saying it's easier to filter yourself than undo a filter that the system did for you automatically.
PHP has its issues, but I don't think it would be as popular as it is if PHP didn't serve a purpose and do it somewhat well.
Re: (Score:1)
Re: (Score:3, Informative)
For multi-threading, install a shared-memory cache, like apc, eAccelerator, or mmcache -- or use an in-memory table in your RDBMS. Now, you can spawn background tasks and monitor their progress or receive return values through the cache. You can even start a task as a server and keep it running indefinitely with set_time_limit(). I do plenty of unicode apps as UTF-8, and haven't had problems yet. If you're talking about UCS-2, then you have a good case. It's in development [php.net], but it's for PHP 6. Honestl
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
Are you implying that those two items are mutually exclusive? I would be very impressed with any software project beyond "Hello World" that has never had a security problem. Having said that, a lot of the negative reputation is because people who haven't written more than 10 lines of PHP code think that phpBB and phpNuke demonstrate the only possible way to write PHP. Any language that lets you ru
Re: (Score:1)
Most of these bugs are completely preventable (Score:2, Insightful)
"double freed memory to bugs in functions that allow attackers to enable register_globals, to memory corruption with unserialize()"
The authors of php should use valgrind, and with a few test cases, could virtually eliminate memory errors.
Memory errors have been around for so long that there are numerous tools for dealing with them, many of them free. I know
yeah yeah yeah (Score:1, Redundant)
Re: (Score:3, Insightful)
PHP is getting better. They are cleaning up security issues, and providing more and more of a solid core of capabilities. I just wish that the users were more excited about these developments. I can't understand why so many continue to develop in PHP4. Every change and step forward gets a mixed response.
Personally, I'm all for breaking conventions if it will result in making PHP a better language. I wish that they would bite the bullet and rename all the functions to follow a consistent style in PHP6. T
Re: (Score:1)
It has been discussed before that many of the larger hosts (GoDaddy, et al) run simple RedHat installations with specific packages of Apache, PHP and MySQL that the
Re: (Score:2)
I can understand that it's not practical to upgrade existing code just for the sake of upgrading. But for new projects, I think maybe you're holding yourself back.
Missing file from 5.2.2 for Win32: php_xmlrpc.dll (Score:1)
http://bugs.php.net/bug.php?id=41292 [php.net]
The file can be obtained from the latest snapshot, though: http://snaps.php.net/ [php.net]
Updating (Score:1)
better (Score:1)
Re: (Score:2)
http://secunia.com/product/3571/?task=advisories [secunia.com]
So yes, while PHP's advisories are about 10 orders of magnatude more numerous than Tomcat's, it still "bug that would let a remote user execute code or change configuration settings or read files or doing a double-free or any of that kind of thing".
And trust me, it's just as easy to create fragile code in Java that can open your server like goatse as it is in
Re: (Score:1, Informative)
Re: (Score:3, Insightful)
Unfortunately, mod_php is still more programmer and administrator friendly than mod_perl, which probably explains why it has a higher usage rate.
Try Fastcgi (Score:2)
With fastcgi you can use perl, python, ruby, C++ or whatever - just like yo
Re: (Score:2)
Re: (Score:2)
The mod_perl stuff tries to do the persistent DB stuff but in a kludgy untidy way that has a lot more gotchas. Same for PHP's mysql_pconnect. Go see people say "turn off persistent DB connections" in one answer and then "turn on persistent DB connections" in another answer
I've tried mod_perl, FastCGI is cleaner,
Re: (Score:1, Insightful)
If people like you were right, we'd all have ditched perl long ago because of the phf bug.
PHP, like any software has its holes, but a properly secured sy