Lecture
PHP — is a general-purpose scripting language oriented towards web development. It was originally created by the Danish-Canadian programmer Rasmus Lerdorf in 1993 and released in 1995. The reference implementation of PHP is currently produced by the PHP Group. PHP was originally an abbreviation for Personal Home Page , , but now it stands for the recursive backronym PHP: Hypertext Preprocessor
PHP code is usually processed on a web server by a PHP interpreter implemented as a module , daemon , or Common Gateway Interface (CGI) executable. On the web server, the result of the interpreted and executed PHP code, which can be any data type, such as generated HTML or binary image data, will form all or part of the HTTP response. There are various web templating systems , content management systems , and web frameworks that can be used to organize or simplify the generation of this response. In addition, PHP can be used for many programming tasks outside of the web context, such as standalone graphical applications and drone control . PHP code can also be executed directly from the command line .
The standard PHP interpreter, running on the Zend Engine , is free software distributed under the PHP License . PHP is widely ported and can be deployed on most web servers across various operating systems and platforms .
The PHP language evolved without a written formal specification or standard, with the original implementation serving as a de facto standard that other implementations sought to follow.
W3Techs reports that as of October 27, 2024 (about two years after PHP 7 support ended and 11 months after the release of PHP 8.3), PHP 7 is still used by 50.0% of PHP websites, which is outdated and known to be insecure. In addition, 13.2% of PHP websites use the even more outdated (unsupported for more than 5 years) and insecure PHP 5 version, and the no-longer-supported PHP 8.0 version is also very popular, meaning most PHP websites do not use supported versions.
Development of PHP began in 1993 , when Rasmus Lerdorf wrote several Common Gateway Interface (CGI) programs in C , which he used to maintain his personal home page . He extended them to work with web forms and interact with databases and called this implementation "Personal Home Page/Forms Interpreter" (Personal Home Page/Forms Interpreter), or PHP/FI.
An example of early PHP syntax :
PHP/FI could be used to build simple dynamic web applications . To speed up error reporting and improve the code, Lerdorf initially announced the release of PHP/FI under the name "Personal Home Page Tools (PHP Tools) version 1.0" on the Usenet discussion group comp.infosystems.www.authoring.cgi on June 8, 1995. This release included basic features such as Perl-style variables , form handling , and the ability to embed HTML . By this point the syntax had changed, resembling Perl , but became simpler, more limited, and less consistent.
Early PHP never set out to become a new programming language ; rather, it evolved organically, and Lerdorf, looking back, noted: "I don't know how to stop it [...] there was never any intention to write a programming language [...] I have absolutely no idea how to write a programming language [...] I just kept adding the next logical step along the way." A development team began to form, and after months of work and beta testing, PHP/FI 2 was officially released in November 1997.
The fact that PHP was not originally designed but evolved organically led to inconsistent function naming and inconsistent parameter ordering. In some cases, function names were chosen to match the lower-level libraries that PHP "wrapped," while in some very early versions of PHP the length of function names was used internally as a hash function , so names were chosen to improve hash value distribution .
Zeev Suraski and Andi Gutmans rewrote the parser in 1997 and formed the foundation of PHP 3, changing the language's name to the recursive acronym PHP: Hypertext Preprocessor . After that, public testing of PHP 3 began, with the official launch taking place in June 1998. Suraski and Gutmans then began a new rewrite of the PHP core, creating the Zend Engine in 1999. They also founded Zend Technologies in Ramat Gan , Israel .
On May 22, 2000, PHP 4 was released, based on Zend Engine 1.0. By August 2008, this version had reached version 4.4.9. PHP 4 is currently no longer under development, and no security updates are planned
On July 1, 2004, PHP 5 was released, based on the new Zend Engine II. PHP 5 included new features such as improved support for object-oriented programming , the PHP Data Objects (PDO) extension (defining a lightweight and consistent interface for accessing databases), as well as numerous performance improvements. In 2008, PHP 5 became the only stable version under development. Late static binding was absent in previous versions of PHP and was added in version 5.3.
Many well-known open source projects dropped support for PHP 4 in new code as of February 5, 2008, due to the GoPHP5 initiative , introduced by a consortium of PHP developers promoting the transition from PHP 4 to PHP 5.
Over time, PHP interpreters became available on most existing 32- and 64-bit operating systems, either by building them from PHP source code or using prebuilt binaries. [ For PHP versions 5.3 and 5.4, the only available Microsoft Windows binary distributions were 32-bit IA-32 builds, requiring 32-bit Windows compatibility mode when using Internet Information Services (IIS) on a 64-bit Windows platform. PHP 5.5 made 64-bit x86-64 builds available for Microsoft Windows.
Official security support for PHP 5.6 ended on December 31, 2018.
PHP received mixed reviews due to the lack of built-in Unicode support at the core language level. In 2005, a project led by Andrei Zmievski was initiated with the goal of introducing built-in Unicode support into PHP by embedding the International Components for Unicode (ICU) library and representing text strings internally as UTF-16. Since this would have led to major changes both in the internal components of the language and in user code, it was planned to be released as version 6.0 of the language along with other major features under development at the time.
However, a shortage of developers who understood the necessary changes, and performance issues arising from converting to and from UTF-16, which is rarely used in the web context, led to delays in the project. As a result, in 2009 the PHP 5.3 release was created, in which many non-Unicode features were ported from PHP 6, in particular namespaces. In March 2010, the project in its current form was officially closed, and the PHP 5.4 release was prepared, containing most of the remaining non-Unicode features from PHP 6, such as traits and closure rebinding. It was initially hoped that a new plan for Unicode integration would be formed, but by 2014 nothing had been adopted.
In 2014 and 2015, a new major version of PHP was developed — PHP 7. The numbering of this version caused some debate among internal developers. Although the PHP 6 Unicode experiments were never published, several articles and book titles referenced the name PHP 6, which could cause confusion if the new version reused that name. After a vote, the name PHP 7 was chosen.
The foundation of PHP 7 is a PHP branch that was originally called PHP next generation ( phpng ). It was written by Dmitry Stogov, Xinchen Hui, and Nikita Popov and aimed at optimizing PHP performance by refactoring the Zend Engine while retaining nearly full language compatibility. By July 14, 2014, WordPress-based benchmarks , which served as the primary test suite for the phpng project, showed almost a 100% increase in performance. The changes from phpng make it easier to boost performance in future versions, since more compact data structures and other changes are considered more suitable for a successful migration to a JIT compiler. Due to the substantial changes, the reworked Zend Engine was named Zend Engine 3 , succeeding Zend Engine 2, used in PHP 5.
Due to the major internal changes in phpng, it had to receive a new major PHP version number rather than being a minor PHP 5 release, according to the PHP release process. Major PHP versions can break code backward compatibility, and so PHP 7 provided an opportunity for other improvements beyond phpng that require backward-compatibility breaks. In particular, the following changes were made:
PHP 7 also introduced new language features. In particular, return type declarations for functions appeared, complementing existing parameter type declarations, as well as support for scalar types (integers, floats, strings, and booleans) in parameter and return type declarations.
PHP 8 was released on November 26, 2020. PHP 8 is a major version and contains substantial changes compared to previous versions. New features and important changes include:
JIT compilation is supported in PHP 8.
The PHP 8 JIT compiler can provide a substantial performance boost in some use cases; PHP developer Nikita Popov stated that the performance improvement for most websites would be less substantial than when upgrading from PHP 5 to PHP 7. It is expected that substantial improvements will be more relevant to mathematical operations than to typical web development cases. In addition, the JIT compiler provides future potential for porting some code from C to PHP due to the performance improvements in certain use cases.
The match expression appeared in PHP 8. The match expression is conceptually similar to the switch statement and is more compact in some cases. Since match is an expression, its result can be assigned to a variable or returned from a function.
PHP 8 introduced union types, a new static return type, and a new mixed type.
PHP 8 added "attributes," which in other programming languages are often called "annotations," allowing metadata to be added to classes
throw was changed from a statement to an expression. This allows exceptions to be thrown in places where it was previously impossible.
PHP 8 introduced changes allowing alternative, more concise, or more consistent syntax in a number of scenarios. For example, the nullsafe operator is similar to the null coalescing operator ?? , but is used when calling methods. The following code snippet will not cause an error if getBirthday() returns null:
Constructor property promotion was added as "syntactic sugar," allowing class properties to be set automatically when parameters are passed to a class constructor . This reduces the amount of boilerplate code that needs to be written.
Other minor changes include support for using ::class on objects, which serves as an alternative to using get_class(); non-capturing catches in try-catch blocks; adjustments to variable syntax to eliminate inconsistencies; support for named arguments; and support for trailing commas in parameter lists, which adds consistency with trailing comma support in other contexts, such as arrays
PHP 8.1 was released on November 25, 2021. It added support for enumerations (also called "enums"), declaring properties as readonly (which prevents a property from being changed after initialization), and unpacking arrays with string keys. The new never type can be used to indicate that a function does not return a value.
PHP 8.2 was released on December 8, 2022. New in this release are readonly classes (whose instance properties are implicitly read-only), disjunctive normal form (DNF) types, and the random extension, which provides a pseudo-random number generator with an object-oriented API , editing sensitive configuration parameter values, and many other features.
PHP 8.3 was released on November 23, 2023. This release introduced readonly array properties, allowing arrays to be declared immutable after initialization. Support for class aliases for built-in PHP classes was also added, along with new random floating-point number generation methods in the Random extension, and improved PHP INI settings with support for fallback values. In addition, the new stream_context_set_options function provides an improved API for managing streams, among other updates and deprecations.
PHP 8.4 was released on November 21, 2024.
Starting June 28, 2011, the PHP development team implemented a release schedule for new PHP versions. Under this system, at least one release must be made every month. Once a year, an additional release must be made, which may include new features. Each additional release must be supported for at least two years with security and bug fixes, followed by at least one more year of security fixes only, for a total three-year release period for each additional release. During the three-year release period, no new features should be added to an additional release, except for small and self-contained ones. In an RFC in 2024, the security fix period was extended to two years, all end-of-life dates were set to December 31, and the exception allowing "small and self-contained" features to be added in patch versions was removed.
ElePHPant, the PHP mascot
The mascot of the PHP project is elePHPant , a blue elephant with the PHP logo on its side, created by Vincent Pontier in 1998. "The letters (PHP) formed the shape of an elephant when viewed from the side."
In the form of a plush toy, elePHPant sometimes comes in a different color. Over the years, many variations of this mascot have been created. Only elePHPants made to Vincent Pontier's original design are considered official in the community. They are collectibles, and some of them are extremely rare.
The following "Hello, World!" program is written in PHP code embedded in an HTML document:
However, since there is no requirement for PHP code to be embedded in HTML, the simplest version of Hello, World! can be written as follows, with the closing tag ?> being omittable, which is preferable in files containing pure PHP code.
echo 'Hello, world!' ;
The PHP interpreter executes only the PHP code within the delimiters . Anything outside the delimiters is not processed by PHP, although non-PHP text is still subject to the control structures described in the PHP code. The most common delimiters are for opening and ?> for closing PHP sections. There is also a shorthand form . This short delimiter makes script files less portable, since its support can be disabled in the local PHP configuration, and therefore its use is not recommended. Conversely, there is no recommendation against the short echo tag . Prior to PHP 5.4.0, this shorthand echo syntax only worked when the short_open_tag configuration setting was enabled, whereas in PHP 5.4.0 and later it is always available. The purpose of all these delimiters is to separate PHP code from non-PHP content, such as JavaScript code or HTML markup. Thus, the shortest "Hello, World!" program written in PHP is:
The first form of delimiters, and ?>, in XHTML and other XML documents creates well-formed XML processing instructions. This means that the resulting mixture of PHP code and other markup in a server-side file is itself well-formed XML.
Variables are prefixed with a dollar sign , and the type does not need to be specified in advance. PHP 5 introduced type declarations , which allow functions to force their parameters to be objects of a specific class, arrays, interfaces, or callbacks . However, prior to PHP 7, type declarations could not be used with scalar types such as integers or strings.
Below is an example of declaring and initializing PHP variables.
$name = 'John' ; // a string type variable is declared and initialized
$age = 18 ; // an integer type variable is declared and initialized
$height = 5.3 ; // a double type variable is declared and initialized
echo $name . ' is ' . $height . "m tall \n " ; // concatenating variables and strings
echo " $name is $age years old." ; // interpolating variables into a string
Unlike function and class names, variable names are case-sensitive. Both double-quoted strings ("") and heredoc strings allow a variable's value to be inserted into a string. PHP treats line breaks as whitespace , as in a free-form language , and statements are terminated with a semicolon. There are three types of comment syntax in PHP : /* */ block and inline comments; // and # are used for single-line comments. The echo statement is one of several tools provided by PHP for outputting text.
In terms of keywords and syntax, the PHP language is similar to C syntax. if conditions, for loops, while, and function returns are similar in syntax to languages such as C, C++, C#, Java, and Perl.
PHP is a weakly typed language . It stores integers in a platform-dependent range, as 32-, 64-, or 128-bit signed integers , equivalent to the long type in C. Unsigned integers are converted to signed integers in certain situations, which differs from the behavior of many other programming languages. Integer variables can be assigned in decimal (positive and negative), octal , hexadecimal , and binary notation.
Floating-point numbers are also stored in a platform-dependent range. They can be specified using floating-point notation or two forms of scientific notation . PHP has its own Boolean type , similar to the native Boolean types in Java and C++ . According to the rules of boolean conversion, non-zero values are interpreted as true, and zero as false, as in Perl and C++.
The null data type represents a variable with no value; NULL is the only valid value for this data type.
Variables of the "resource" type represent references to resources from external sources. They are usually created by functions of a specific extension and can only be handled by functions of that same extension; examples include file, image, and database resources.
Arrays can contain elements of any type supported by PHP, including resources, objects, and even other arrays. Order is preserved in lists of values and in hashes containing both keys and values, and they can be mixed. PHP also supports strings , which can be used with single and double quotes, as well as nowdoc or heredoc syntax
The Standard PHP Library (SPL) attempts to solve standard problems and implements efficient data access interfaces and classes.
PHP defines a large array of functions in the core language, and many of them are also available in various extensions; these functions are well documented in the online PHP documentation . However, the built-in library has a wide range of naming conventions and related inconsistencies, as described in the "History" section above.
A developer can define custom functions:
function myAge ( int $birthYear ) : string
{
// calculate the age by subtracting the birth year from the current year.
$yearsOld = date ( 'Y' ) - $birthYear ;
// return the age as a descriptive string.
return $yearsOld . ( $yearsOld == 1 ? ' year' : ' years' );
}
echo 'I am now ' . myAge ( 1995 ) . ' old.' ;
As of 2035, the output of the above program would be: "I am now 40 years old."
Instead of function pointers, in PHP functions can be referenced by a string containing their name. Thus, regular PHP functions can be used, for example, as callbacks or in function tables . Custom functions can be created at any time without prototyping . Functions can be defined inside code blocks, allowing the decision of whether to define a function to be made at runtime. There is a function_exists function that determines whether a function with a given name has already been defined. Function calls must include parentheses, except for zero-argument class constructor functions called with the PHP new operator, in which case parentheses are optional.
Starting with PHP 4.0.1, create_function(), a thin wrapper around [ eval()], allowed regular PHP functions to be created at program runtime; it was deprecated in PHP 7.2 and removed in PHP 8.0 in favor of anonymous function syntax, or "closures" , which can capture variables from the enclosing scope, added in PHP 5.3. Shorthand arrow syntax was added in PHP 7.4:
function getAdder ( $x ) {
return fn ( $y ) => $x + $y ;
}
$adder = getAdder ( 8 );
echo $adder ( 2 ); // outputs "10"
In the example above, the getAdder() function creates a closure using the passed argument $x, which accepts an additional argument $y and returns the created closure to the caller. Such a function is a first-class object, meaning it can be stored in a variable, passed as a parameter to other functions, and so on.
Unusually for a dynamically typed language, PHP supports type declarations for function parameters, which are enforced at runtime. This has been supported for classes and interfaces since PHP 5.0, for arrays since PHP 5.1, for callables since PHP 5.4, and for scalar types (integers, floats, strings, and booleans) since PHP 7.0. PHP 7.0 also has type declarations for function return values, specified by placing a type name after the parameter list, preceded by a colon. For example, the getAdder function from the previous example can be annotated with types in PHP 7 as follows:
function getAdder ( int $x ) : Closure
{
return fn ( int $y ) : int => $x + $y ;
}
$adder = getAdder ( 8 );
echo $adder ( 2 ); // outputs "10"
echo $adder ( null ); // throws an exception, since an invalid type was passed
$adder = getAdder ([]); // will also throw an exception
By default, scalar type declarations follow the principles of weak typing. So, for example, if a parameter's type is int, PHP will allow not only integers to be passed to that function, but also convertible numeric strings, floats, or booleans, and will convert them. However, PHP 7 has a "strict typing" mode, which, when used, prohibits such conversions for function calls and returns within a file.
Basic object-oriented programming functionality was added in PHP 3 and improved in PHP 4. This allowed PHP to gain additional abstraction, simplifying creative tasks for programmers using the language. Object handling was completely rewritten for PHP 5, which expanded the feature set and improved performance. In previous versions of PHP, objects were handled as value types . The downside of this method was that code had to actively use PHP "reference" variables if it wanted to modify a passed object rather than create a copy of it. In the new approach, objects are referenced by handle rather than by value.
PHP 5 introduced private and protected member variables and methods, along with abstract classes , final classes , abstract methods , and final methods . It also introduced a standard way of declaring constructors and destructors , similar to other object-oriented languages such as C++ , and a standard exception handling model . In addition, PHP 5 added interfaces and allowed multiple interfaces to be implemented. There are special interfaces that allow objects to interact with the runtime system. Objects implementing ArrayAccess can be used with array syntax , and objects implementing Iterator or IteratorAggregate can be used with the foreach language construct . There is no virtual table feature in the engine, so static variables are bound to the name rather than a reference at compile time.
If a developer creates a copy of an object using the reserved word clone, the Zend engine checks whether a __clone() method is defined. If not, it calls the default __clone() method, which copies the object's properties. If a __clone() method is defined, it will be responsible for setting the necessary properties on the newly created object. For convenience, the engine will provide a function that imports the properties of the original object, so the programmer can start with a copy of the original object by value and override only the properties that need to be changed.
The visibility of PHP properties and methods is determined by keywords. The default value is public if only var is used ; it is a synonym for it. Declared elements are accessible from everywhere. Protected restricts access to inherited classes (and the class that defines the element). Private restricts visibility to only the class that defines the element. Objects of the same type have access to each other's private and protected members, even if they are not the same instance.
The only complete implementation of PHP is the original one, known simply as PHP. It is the most widely used and is based on the Zend Engine . To distinguish it from other implementations, it is sometimes informally called "Zend PHP." The Zend Engine compiles PHP source code "on the fly" into an internal format it can execute, thus functioning as an interpreter . It is also the "reference implementation" of PHP, since PHP has no formal specification, and therefore the semantics of Zend PHP define the semantics of PHP. Due to the complex and multifaceted semantics of PHP, defined by the workings of Zend, it is difficult for competing implementations to achieve full compatibility.
The PHP model of one request per script execution, and the fact that the Zend Engine is an interpreter, lead to inefficiency; as a result, various products have been developed to improve PHP performance. To speed up execution and avoid the need to compile PHP source code on every web page request, PHP scripts can also be deployed in the PHP engine's internal format using an opcode cache , which works by caching the compiled form of a PHP script (opcodes) in shared memory to avoid the overhead of parsing and compiling the code on every script run. The opcode cache, Zend Opcache , has been built into PHP since version 5.5. Another example of a widely used opcode cache is the Alternative PHP Cache (APC), which is available as a PECL extension .
Although Zend PHP remains the most popular implementation, several others have been developed. Some of them are compilers or support JIT compilation , providing higher performance compared to Zend PHP at the cost of not having full PHP compatibility. Alternative implementations include:
PHP — is free software , released under the PHP License , which states:
Products derived from this software may not be called "PHP," nor may the word "PHP" appear in their name, without prior written permission from group@php.net. You may indicate that your software works with PHP by stating "Foo for PHP" instead of "PHP Foo" or "phpfoo."
This restriction on the use of "PHP" makes the PHP License incompatible with the GNU General Public License (GPL), while the Zend License is incompatible due to an advertising clause similar to the clause in the original BSD License .
PHP includes various free open-source libraries in the source distribution or uses them in prebuilt PHP binary builds. PHP is, in essence, an internet system with built-in modules for accessing FTP servers and many database servers, including PostgreSQL , MySQL , Microsoft SQL Server and SQLite (an embedded database), LDAP servers, and others. Numerous functions familiar to C programmers, such as functions from the stdio family, are available in standard PHP builds.
PHP allows developers to write extensions in C to add functionality to the PHP language. PHP extensions can be statically compiled into PHP or dynamically loaded at runtime. Many extensions have been written to add support for the Windows API , process management on Unix-like operating systems , multibyte strings ( Unicode ), cURL , and several popular compression formats . Other PHP capabilities available through extensions include integration with Internet Relay Chat (IRC), dynamic generation of images and Adobe Flash content, PHP Data Objects (PDO) as an abstraction layer used for accessing databases, and even speech synthesis . Some of the core language functions, such as those working with strings and arrays, are also implemented as extensions. The PHP Extension Community Library (PECL) project is a repository of PHP language extensions.
Some other projects, such as Zephir , provide the ability to create PHP extensions in a high-level language and compile them into native PHP extensions. This approach, instead of writing PHP extensions directly in C, simplifies extension development and reduces the time needed for programming and testing.
As of December 2018, the PHP Group consisted of ten people: Thies C. Arntzen , Stig Bakken , Shane Caraveo , Andi Gutmans , Rasmus Lerdorf , Sam Ruby , Sascha Schumann , Zeev Suraski , Jim Winstead, and Andrei Zmievski .
Zend Technologies offers programmers PHP certification based on the PHP 8 exam (previously based on PHP 7 and 5.5), so they can become certified PHP developers.
Example output of the phpinfo() function in PHP 7.1
There are two main ways to add PHP support to a web server: as a native web server module, or as a CGI executable. PHP has a direct modular interface called the Server Application Programming Interface (SAPI), which is supported by many web servers, including Apache HTTP Server , Microsoft IIS , and iPlanet Web Server . Some other web servers, such as OmniHTTPd, support the Internet Server Application Programming Interface (ISAPI), which is Microsoft's web server module interface . If PHP does not support a module for a web server, it can always be used as a Common Gateway Interface (CGI) or FastCGI processor; in this case the web server is configured to use the PHP CGI executable to handle all requests to PHP files. [
PHP-FPM (FastCGI Process Manager) — is an alternative FastCGI implementation for PHP, included in the official PHP distribution since version 5.3.3. Compared to the older FastCGI implementation, it contains some additional features, mostly useful for high-load web servers.
When using PHP to write command-line scripts, the PHP command-line interface (CLI) executable is required. PHP has supported the command-line Server Application Programming Interface (SAPI) since PHP version 4.3.0. The main focus of this SAPI is on developing application shells in PHP. There are quite a few differences between the CLI SAPI and other SAPIs, although many of them behave similarly.
PHP has a direct modular SAPI interface for various web servers; in the case of PHP 5 and Apache 2.0 on Windows, it is presented as a DLL file php5apache2.dll , a module that, among other things, provides an interface between PHP and the web server, implemented in a form the server understands. This form is called SAPI.
There are various types of SAPI for various web server extensions. For example, in addition to those listed above, there are other SAPIs for the PHP language, including Common Gateway Interface and the command-line interface.
PHP can also be used to write graphical user interface (GUI) applications for desktop computers using "PHP Desktop" . GitHub . or the discontinued PHP-GTK extension. PHP-GTK is not included in the official PHP distribution and, as an extension, can only be used with PHP versions 5.1.0 and newer. The most common way to install PHP-GTK is to compile it from source.
When installing and using PHP in cloud environments, software development kits (SDKs) are provided for using cloud functions. For example:
Numerous configuration options are supported, affecting both the core PHP functionality and extensions. The php.ini configuration file is searched for in different locations depending on how PHP is used. The configuration file is divided into several sections, and some configuration options can also be set in the web server's configuration.
A broad overview of LAMP software, shown here together with Squid
PHP — is a general-purpose scripting language particularly well-suited to server-side web development , in which case PHP typically runs on a web server . Any PHP code in a requested file is executed by the PHP runtime, usually to generate dynamic web page content or dynamic images used on websites or elsewhere. [ 289 ] It can also be used to write command-line scripts and client-side graphical user interface (GUI) applications. PHP can be deployed on most web servers, on many operating systems and platforms , and with many relational database management systems (RDBMS). Most web hosting providers support PHP for their customers' use. It is available free of charge, and the PHP Group provides users full source code to build, customize, and extend for their own use.
Dynamic web page: an example of a server-side script (PHP and MySQL)
Originally designed for creating dynamic web pages , PHP now mostly focuses on server-side scripting and resembles other server-side scripting languages that deliver dynamic content from a web server to a client, such as Python, Microsoft ASP.NET, Sun Microsystems JavaServer Pages, and mod_perl. PHP has also inspired the development of many software frameworks , which provide building blocks and a design structure to facilitate rapid application development (RAD). Some of these include PRADO , CakePHP , Symfony , CodeIgniter , Laravel , Yii Framework , Phalcon , and Laminas , offering features similar to other web frameworks .
The LAMP architecture became popular in the web industry as a way to deploy web applications. PHP is typically used as the P in this stack alongside Linux , Apache , and MySQL , although P can also refer to Python , Perl , or some mix of the three. Similar stacks, WAMP and MAMP , are also available for Windows and macOS , with the first letter denoting the corresponding operating system. Although both PHP and Apache are provided as part of the base macOS installation, users of these stacks look for a simpler installation mechanism that would be easier to keep up to date.
For specific and more complex use cases, PHP offers a well-defined and documented way to write custom extensions in C or C++ . In addition to extending the language itself in the form of additional libraries , extensions provide a way to increase execution speed where it is critical and there is room for improvement through the use of a genuinely compiled language . PHP also offers well-defined ways to embed itself in other software projects. Thus, PHP can be easily used as an internal scripting language for another project, while also providing close interaction with the project's specific internal data structures .
PHP received mixed reviews due to the lack of core-language-level multithreading support , although the use of threads has become possible thanks to the PECL extension "pthreads" .
A command-line interface, php-cli, and two ActiveX Windows Script Host scripting engines for PHP have been created.
In 2019, 11% of all vulnerabilities listed in the National Vulnerability Database were related to PHP; historically, about 30% of all vulnerabilities listed since 1996 in that database are related to PHP. Technical security flaws in the language itself or its core libraries are rare (22 in 2009, about 1% of the total, although PHP is used in approximately 20% of listed programs). Recognizing that programmers make mistakes, some languages include taint checking to automatically detect the lack of input validation , which causes many problems. Such a feature has been proposed for PHP in the past, but was either rejected or the proposal was withdrawn.
Third-party projects, such as Suhosin and Snuffleupagus , aim to remove or modify dangerous parts of the language.
Historically, older versions of PHP had certain configuration settings and default values for such runtime parameters that made some PHP applications vulnerable to security issues. Among these, the most notorious are the magic_quotes_gpc and register_globals configuration directives ; the latter turned any URL parameters into PHP variables, opening the door to serious security vulnerabilities by allowing an attacker to set the value of any uninitialized global variable and interfere with the execution of a PHP script. Support for "magic quotes" and "register globals" settings was deprecated as of PHP 5.3.0 and removed in PHP 5.4.0.
Another example of a potential runtime settings vulnerability is failing to disable PHP execution (for example, via the engine configuration directive) for a directory where uploaded files are stored; enabling this directive can lead to the execution of malicious code embedded in uploaded files. Best practice is either to place the image directory outside the document root accessible to the web server and serve it through an intermediary script, or to disable PHP execution for the directory where uploaded files are stored.
In addition, enabling dynamic loading of PHP extensions (via the enable_dl directive) in a shared web hosting environment can lead to security issues.
Implicit type conversions , causing different values to be treated as equal, sometimes contrary to the programmer's intent, can lead to security issues. For example, the result of comparing '0e1234' == '0' will be true, since strings that can be interpreted as numbers are converted to numbers; in this case, the first compared value is treated as scientific notation with the value (0 × 10 1234 ), which equals zero. Similar bugs led to authentication vulnerabilities in the Simple Machines Forum, Typo3, and phpBB when comparing MD5 password hashes. It is recommended to use hash_equals() (to protect against timing attacks ) or the identity operator (===), as shown in '0e1234' === '0' false.
In an analysis of more than 170,000 website defacement cases published by Zone-H in 2013 , the most frequently (53%) used technique was exploitation of a file inclusion vulnerability , mostly related to unsafe use of the PHP language constructs include, require, and allow_url_fopen.
PHP has the rand() and mt_rand() functions, which use a pseudo-random number generator and are not cryptographically secure. Starting with version 8.1, the random_int() function is included, using a cryptographically secure source of random numbers provided by the system.
There are two attacks that can be carried out through PHP's entropy sources: the "source code attack" and the "state recovery attack." As of 2012, a $250 GPU can perform up to 230 MD5 computations per second, while a $750 GPU can perform four times as many computations simultaneously. Combined with a "birthday attack ," this can lead to serious security vulnerabilities.
The PHP development team provides official bug fixes for two years after each minor version release, followed by another two years during which only security fixes are released. After that, the release is considered to have reached end of life and is no longer officially supported.
Extended long-term support is provided by commercial vendors, such as Zend and others
Comments