diff /etc/php5/apache2/php.ini /usr/share/doc/php5-common/examples/php.ini-recommended
3,13d2
< ;;;;;;;;;;;
< ; WARNING ;
< ;;;;;;;;;;;
< ; This is the default settings file for new PHP installations.
< ; By default, PHP installs itself with a configuration suitable for
< ; development purposes, and *NOT* for production purposes.
< ; For several security-oriented considerations that should be taken
< ; before going online with your site, please consult php.ini-recommended
< ; and http://php.net/manual/en/security.php.
<
<
57c46
< ;
---
> ;
62,65c51,110
< ; All the values in the php.ini-dist file correspond to the builtin
< ; defaults (that is, if no php.ini is used, or if you delete these lines,
< ; the builtin defaults will be identical).
<
---
> ; This is the recommended, PHP 5-style version of the php.ini-dist file. It
> ; sets some non standard settings, that make PHP more efficient, more secure,
> ; and encourage cleaner coding.
> ;
> ; The price is that with these settings, PHP may be incompatible with some
> ; applications, and sometimes, more difficult to develop with. Using this
> ; file is warmly recommended for production sites. As all of the changes from
> ; the standard settings are thoroughly documented, you can go over each one,
> ; and decide whether you want to use it or not.
> ;
> ; For general information about the php.ini file, please consult the php.ini-dist
> ; file, included in your PHP distribution.
> ;
> ; This file is different from the php.ini-dist file in the fact that it features
> ; different values for several directives, in order to improve performance, while
> ; possibly breaking compatibility with the standard out-of-the-box behavior of
> ; PHP. Please make sure you read what's different, and modify your scripts
> ; accordingly, if you decide to use this file instead.
> ;
> ; - register_long_arrays = Off [Performance]
> ; Disables registration of the older (and deprecated) long predefined array
> ; variables ($HTTP_*_VARS). Instead, use the superglobals that were
> ; introduced in PHP 4.1.0
> ; - display_errors = Off [Security]
> ; With this directive set to off, errors that occur during the execution of
> ; scripts will no longer be displayed as a part of the script output, and thus,
> ; will no longer be exposed to remote users. With some errors, the error message
> ; content may expose information about your script, web server, or database
> ; server that may be exploitable for hacking. Production sites should have this
> ; directive set to off.
> ; - log_errors = On [Security]
> ; This directive complements the above one. Any errors that occur during the
> ; execution of your script will be logged (typically, to your server's error log,
> ; but can be configured in several ways). Along with setting display_errors to off,
> ; this setup gives you the ability to fully understand what may have gone wrong,
> ; without exposing any sensitive information to remote users.
> ; - output_buffering = 4096 [Performance]
> ; Set a 4KB output buffer. Enabling output buffering typically results in less
> ; writes, and sometimes less packets sent on the wire, which can often lead to
> ; better performance. The gain this directive actually yields greatly depends
> ; on which Web server you're working with, and what kind of scripts you're using.
> ; - register_argc_argv = Off [Performance]
> ; Disables registration of the somewhat redundant $argv and $argc global
> ; variables.
> ; - magic_quotes_gpc = Off [Performance]
> ; Input data is no longer escaped with slashes so that it can be sent into
> ; SQL databases without further manipulation. Instead, you should use the
> ; function addslashes() on each input element you wish to send to a database.
> ; - variables_order = "GPCS" [Performance]
> ; The environment variables are not hashed into the $_ENV. To access
> ; environment variables, you can use getenv() instead.
> ; - error_reporting = E_ALL [Code Cleanliness, Security(?)]
> ; By default, PHP suppresses errors of type E_NOTICE. These error messages
> ; are emitted for non-critical errors, but that could be a symptom of a bigger
> ; problem. Most notably, this will cause error messages about the use
> ; of uninitialized variables to be displayed.
> ; - allow_call_time_pass_reference = Off [Code cleanliness]
> ; It's not possible to decide to force a variable to be passed by reference
> ; when calling a function. The PHP 4 style to do this is by making the
> ; function require the relevant argument by reference.
83c128
< short_open_tag = On
---
> short_open_tag = Off
89c134
< precision = 12
---
> precision = 14
101c146
< output_buffering = Off
---
> output_buffering = 4096
164c209
< allow_call_time_pass_reference = On
---
> allow_call_time_pass_reference = Off
169,173d213
< ; NOTE: this is considered a "broken" security measure.
< ; Applications relying on this feature will not recieve full
< ; support by the security team. For more information please
< ; see /usr/share/doc/php5-common/README.Debian.security
< ;
210,216d249
<
< ; NOTE: this is considered a "broken" security measure.
< ; Applications relying on this feature will not recieve full
< ; support by the security team. For more information please
< ; see /usr/share/doc/php5-common/README.Debian.security
< ;
<
314c347
< ; - Show all errors except for notices and coding standards warnings
---
> ; - Show all errors, except coding standards warnings
316c349
< error_reporting = E_ALL & ~E_NOTICE
---
> error_reporting = E_ALL
323c356
< display_errors = On
---
> display_errors = Off
333c366
< log_errors = Off
---
> log_errors = On
404c437
< variables_order = "EGPCS"
---
> variables_order = "GPCS"
415,419d447
<
< ; NOTE: applications relying on this feature will not recieve full
< ; support by the security team. For more information please
< ; see /usr/share/doc/php5-common/README.Debian.security
< ;
425c453
< register_long_arrays = On
---
> register_long_arrays = Off
430c458
< register_argc_argv = On
---
> register_argc_argv = Off
446c474
< magic_quotes_gpc = On
---
> magic_quotes_gpc = Off
492c520
< ; extension_dir = "./"
---
> ;extension_dir = "./"
596d623
<
910c937
< ;session.cookie_secure =
---
> ;session.cookie_secure =
947c974
< session.gc_divisor = 100
---
> session.gc_divisor = 1000
967c994
< session.bug_compat_42 = 1
---
> session.bug_compat_42 = 0
1014c1041
< session.hash_bits_per_character = 4
---
> session.hash_bits_per_character = 5
1021c1048
< url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=,fieldset="
---
> url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry"
1144a1172,1174
> ; enable strict encoding detection.
> ;mbstring.strict_encoding = Off
>