Web Info About: php.net

Alexa Stat

 

Quantcast Stat

 

Compete Stat

 

Google Pagerank

9/10

TITLE: PHP: Hypertext Preprocessor ,

Website links according to order they appear.

PHP: Hypertext Preprocessor . search for in the all php.net sites this mirror only function list online documentation bug database Site News Archive All Changelogs just pear.php.net just pecl.php.net just talks.php.net general mailing list developer mailing list documentation mailing list What is PHP PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. If you are new to PHP and want to get some idea of how it works try the . . After that check out the online . and the example archive sites and some of the other resources available in the . . Ever wondered how popular PHP is See the . . . Related sites . Community . Syndication You can grab our news as an . . Stable Releases . Upcoming Events . May User Group Events 28. . 28. . 28. . 29. . 29. . 29. . 29. . 29. . 30. . 30. . 30. . 31. . 31. . 31. . June Conferences 05. . 07. . 09. . 29. . User Group Events 01. . 01. . 03. . 03. . 04. . 05. . 05. . 05. . 05. . 05. . 06. . 06. . 06. . 07. . 07. . 07. . 07. . 07. . 07. . 07. . 07. . 07. . 07. . 07. . 07. . 07. . 07. . 07. . 07. . 07. . 07. . 09. . 09. . 09. . 09. . 10. . 11. . 12. . 12. . 12. . 12. . 12. . 12. . 12. . 12. . 12. . 12. . 13. . 13. . 13. . 13. . 13. . 14. . 14. . 14. . 14. . 16. . 16. . 16. . 16. . 19. . 19. . 19. . 19. . 19. . 20. . 20. . 20. . 20. . 21. . 21. . 21. . 21. . 21. . 21. . 25. . 25. . 25. . 26. . 26. . 26. . 26. . 26. . 26. . 26. . 26. . 26. . 27. . 27. . 27. . 27. . 28. . 28. . 28. . 28. . 30. . 30. . 30. . Training 01. . 02. . 02. . 03. . 03. . 04. . 04. . 04. . 04. . 04. . 04. . 04. . 04. . 04. . 04. . 04. . 04. . 04. . 05. . 05. . 06. . 06. . 06. . 07. . 11. . 11. . 11. . 11. . 11. . 11. . 11. . 11. . 11. . 13. . 13. . 14. . 15. . 18. . 18. . 18. . 19. . 21. . 25. . 26. . 26. . 28. . 28. . 29. . Upcoming conferences: . Calling for papers: . 08-May-2012 The PHP development team would like to announce the immediate availability of PHP 5.4.3 and PHP 5.3.13. All users are encouraged to upgrade to PHP 5.4.3 or PHP 5.3.13 The releases complete a fix for a . in CGI-based setups CVE-2012-2311. Note: mod_php and php-fpm are not vulnerable to this attack. PHP 5.4.3 fixes a buffer overflow vulnerability in the . CVE-2012-2329. The PHP 5.3 series is not vulnerable to this issue. For source downloads of PHP 5.4.3 and PHP 5.3.13 please visit our . Windows binaries can be found on . . The list of changes are recorded in the . . . 06-May-2012 PHP 5.3.12/5.4.2 do not fix all variations of the CGI issues describedin CVE-2012-1823. It has also come to our attention that some sites usean insecure cgiwrapper script to run PHP. These scripts will use instead of "" to pass parameters to php-cgi which causes a number ofissues. Again people using mod_php or php-fpm are not affected. One way to address these CGI issues is to reject the request if the query stringcontains a '-' and no '='. It can be done using Apache's mod_rewrite like this:RewriteCond QUERY_STRING =RewriteCond QUERY_STRING 2d- NCRewriteRule . - FLNote that this will block otherwise safe requests like top-40 so if youhave query parameters that look like that adjust your regex accordingly. Another set of releases are planned for Tuesday May 8th. Thesereleases will fix the CGI flaw and another CGI-related issue inapache_request_header 5.4 only. We apologize for the inconvenience created with these releases and thelack of communication around them. . 03-May-2012 There is a vulnerability in certain CGI-based setups Apache+mod_php and nginx+php-fpm are not affected that has gone unnoticed for at least 8 years. . states: Some systems support a method for supplying a sic array of strings to theCGI script. This is only used in the case of an indexed' query. Thisis identified by a "GET" or "HEAD" HTTP request with a URL searchstring not containing any unencoded "=" characters. So requests that do not have a "=" in the query string are treated differently from those who do in some CGI implementations. For PHP this means that a request containing -s may dump the PHP source code for the page but a request that has -s&=1 is fine. A large number of sites run PHP as either an Apache module through mod_php or using php-fpm under nginx. Neither of these setups are vulnerable to this. Straight shebang-style CGI also does not appear to be vulnerable. If you are using Apache mod_cgi to run PHP you may be vulnerable. To see if you are just add -s to the end of any of your URLs. If you see your source code you are vulnerable. If your site renders normally you are not. To fix this update to PHP 5.3.12 or PHP 5.4.2. We recognize that since CGI is a rather outdated way to run PHP it may not be feasible to upgrade these sites to a modern version of PHP. An alternative is to configure your web server to not let these types of requests with query strings starting with a "-" and not containing a "=" through. Adding a rule like this should not break any sites. For Apache using mod_rewrite it would look like this: RewriteCond QUERY_STRING 2d-=+ NC RewriteRule . 1 L If you are writing your own rule be sure to take the urlencoded 2ds version into account. Making a bad week worse we had a bug in our bug system that toggled the private flag of a bug report to public on a comment to the bug report causing this issue to go public before we had time to test solutions to the level we would like. Please report any issues via . . For source downloads of PHP 5.3.12 and PHP 5.4.2 please visit our . Windows binaries can be found on . . A . exists. . 26-Apr-2012 The PHP development team announces the immediate availability of PHP 5.3.11 and PHP 5.4.1. These releases focuses on improving the stability of the current PHP branches with over 60 bug fixes some of which are security related. Security Enhancements for both PHP 5.3.11 and PHP 5.4.1: Fixed bug #54374 Insufficient validating of upload name leading to corrupted _FILES indices. CVE-2012-1172. Add open_basedir checks to readline_write_history and readline_read_history. Security Enhancement affecting PHP 5.3.11 only: Fixed bug #61043 Regression in magic_quotes_gpc fix for CVE-2012-0831. Key enhancements in these releases include: Added debug info handler to DOM objects. Fixed bug #61172 Add Apache 2.4 support. For a full list of changes in PHP 5.3.11 and PHP 5.4.1 see the . . For source downloads please visit our . Windows binaries can be found on . . All users of PHP are strongly encouraged to upgrade to PHP 5.3.11 or PHP 5.4.1. . 13-Apr-2012 The PHP development team would like to announce the 2nd. of PHP 5.4.1. Windows binaries can be downloaded from the. . THIS IS A RELEASE CANDIDATE - DO NOT USE IT IN PRODUCTION This is the 2nd release candidate. The release candidate phase isintended as a period of bug fixing prior to the stable release.The release candidate fixes a critical issue when using the internalclasses in multiple threads. A complete list of changes since the last release candidate can befound in the. file. Please help us to identifybugs in order to ensure that the release is solid and all things behaveas expected by taking the time to test this release candidate againstyour code base and reporting any problems that you encounter tothe . and/orthe . . PHP 5.4.1 final will be released on April 26. . All rights reserved. . generously provided by:. Last updated: Sun May 27 06:01:04 2012 UTC

Use the contact form to report about this website (php.net).

Submit your site to view stats.

Enter Web Address:http://

Recently added sites

Random

Waiting for review.