--- php.ini Tue Feb 27 16:06:01 2007
+++ /usr/local/share/examples/php5/php.ini-recommended Fri Sep 1 05:10:59 2006
@@ -1,16 +1,5 @@
[PHP]
-;;;;;;;;;;;
-; WARNING ;
-;;;;;;;;;;;
-; This is the default settings file for new PHP installations.
-; By default, PHP installs itself with a configuration suitable for
-; development purposes, and *NOT* for production purposes.
-; For several security-oriented considerations that should be taken
-; before going online with your site, please consult php.ini-recommended
-; and http://php.net/manual/en/security.php.
-
-
;;;;;;;;;;;;;;;;;;;
; About php.ini ;
;;;;;;;;;;;;;;;;;;;
@@ -54,14 +43,83 @@
; If you use constants in your value, and these constants belong to a
; dynamically loaded extension (either a PHP extension or a Zend extension),
; you may only use these constants *after* the line that loads the extension.
+;
;
-;
;;;;;;;;;;;;;;;;;;;
; About this file ;
;;;;;;;;;;;;;;;;;;;
-; All the values in the php.ini-dist file correspond to the builtin
-; defaults (that is, if no php.ini is used, or if you delete these lines,
-; the builtin defaults will be identical).
+; This is the recommended, PHP 5-style version of the php.ini-dist file. It
+; sets some non standard settings, that make PHP more efficient, more secure,
+; and encourage cleaner coding.
+;
+; The price is that with these settings, PHP may be incompatible with some
+; applications, and sometimes, more difficult to develop with. Using this
+; file is warmly recommended for production sites. As all of the changes from
+; the standard settings are thoroughly documented, you can go over each one,
+; and decide whether you want to use it or not.
+;
+; For general information about the php.ini file, please consult the php.ini-dist
+; file, included in your PHP distribution.
+;
+; This file is different from the php.ini-dist file in the fact that it features
+; different values for several directives, in order to improve performance, while
+; possibly breaking compatibility with the standard out-of-the-box behavior of
+; PHP. Please make sure you read what's different, and modify your scripts
+; accordingly, if you decide to use this file instead.
+;
+; - register_globals = Off [Security, Performance]
+; Global variables are no longer registered for input data (POST, GET, cookies,
+; environment and other server variables). Instead of using $foo, you must use
+; you can use $_REQUEST["foo"] (includes any variable that arrives through the
+; request, namely, POST, GET and cookie variables), or use one of the specific
+; $_GET["foo"], $_POST["foo"], $_COOKIE["foo"] or $_FILES["foo"], depending
+; on where the input originates. Also, you can look at the
+; import_request_variables() function.
+; Note that register_globals is going to be depracated (i.e., turned off by
+; default) in the next version of PHP, because it often leads to security bugs.
+; Read http://php.net/manual/en/security.registerglobals.php for further
+; information.
+; - register_long_arrays = Off [Performance]
+; Disables registration of the older (and deprecated) long predefined array
+; variables ($HTTP_*_VARS). Instead, use the superglobals that were
+; introduced in PHP 4.1.0
+; - display_errors = Off [Security]
+; With this directive set to off, errors that occur during the execution of
+; scripts will no longer be displayed as a part of the script output, and thus,
+; will no longer be exposed to remote users. With some errors, the error message
+; content may expose information about your script, web server, or database
+; server that may be exploitable for hacking. Production sites should have this
+; directive set to off.
+; - log_errors = On [Security]
+; This directive complements the above one. Any errors that occur during the
+; execution of your script will be logged (typically, to your server's error log,
+; but can be configured in several ways). Along with setting display_errors to off,
+; this setup gives you the ability to fully understand what may have gone wrong,
+; without exposing any sensitive information to remote users.
+; - output_buffering = 4096 [Performance]
+; Set a 4KB output buffer. Enabling output buffering typically results in less
+; writes, and sometimes less packets sent on the wire, which can often lead to
+; better performance. The gain this directive actually yields greatly depends
+; on which Web server you're working with, and what kind of scripts you're using.
+; - register_argc_argv = Off [Performance]
+; Disables registration of the somewhat redundant $argv and $argc global
+; variables.
+; - magic_quotes_gpc = Off [Performance]
+; Input data is no longer escaped with slashes so that it can be sent into
+; SQL databases without further manipulation. Instead, you should use the
+; function addslashes() on each input element you wish to send to a database.
+; - variables_order = "GPCS" [Performance]
+; The environment variables are not hashed into the $_ENV. To access
+; environment variables, you can use getenv() instead.
+; - error_reporting = E_ALL [Code Cleanliness, Security(?)]
+; By default, PHP surpresses errors of type E_NOTICE. These error messages
+; are emitted for non-critical errors, but that could be a symptom of a bigger
+; problem. Most notably, this will cause error messages about the use
+; of uninitialized variables to be displayed.
+; - allow_call_time_pass_reference = Off [Code cleanliness]
+; It's not possible to decide to force a variable to be passed by reference
+; when calling a function. The PHP 4 style to do this is by making the
+; function require the relevant argument by reference.
;;;;;;;;;;;;;;;;;;;;
@@ -80,13 +138,13 @@
; servers which are not under your control, because short tags may not
; be supported on the target server. For portable, redistributable code,
; be sure not to use short tags.
-short_open_tag = On
+short_open_tag = Off
; Allow ASP-style <% %> tags.
asp_tags = Off
; The number of significant digits displayed in floating point numbers.
-precision = 12
+precision = 14
; Enforce year 2000 compliance (will cause problems with non-compliant browsers)
y2k_compliance = On
@@ -98,7 +156,7 @@
; setting this directive to On. If you wish to limit the size of the buffer
; to a certain size - you can use a maximum number of bytes instead of 'On', as
; a value for this directive (e.g., output_buffering=4096).
-output_buffering = Off
+output_buffering = 4096
; You can redirect all of the output of your scripts to a function. For
; example, if you set output_handler to "mb_output_handler", character
@@ -160,7 +218,7 @@
; with future versions of the language (you will receive a warning each time
; you use this feature, and the argument will be passed by value instead of by
; reference).
-allow_call_time_pass_reference = On
+allow_call_time_pass_reference = Off
;
; Safe Mode
@@ -271,7 +329,7 @@
; intentional (e.g., using an uninitialized variable and
; relying on the fact it's automatically initialized to an
; empty string)
-; E_STRICT - run-time notices, enable to have PHP suggest changes
+; E_STRICT - run-time notices, enable to have PHP suggest changes
; to your code which will ensure the best interoperability
; and forward compatibility of your code
; E_CORE_ERROR - fatal errors that occur during PHP's initial startup
@@ -297,16 +355,16 @@
;
;error_reporting = E_COMPILE_ERROR|E_ERROR|E_CORE_ERROR
;
-; - Show all errors except for notices and coding standards warnings
+; - Show all errors, except coding standards warnings
;
-error_reporting = E_ALL & ~E_NOTICE
+error_reporting = E_ALL
; Print out errors (as a part of the output). For production web sites,
; you're strongly encouraged to turn this feature off, and use error logging
; instead (see below). Keeping display_errors enabled on a production web site
; may reveal security information to end users, such as file paths on your Web
; server, your database schema or other information.
-display_errors = On
+display_errors = Off
; Even when display_errors is on, errors that occur during PHP's startup
; sequence are not displayed. It's strongly recommended to keep
@@ -316,7 +374,7 @@
; Log errors into a log file (server-specific log, stderr, or error_log (below))
; As stated above, you're strongly advised to use error logging in place of
; error displaying on production web sites.
-log_errors = Off
+log_errors = On
; Set maximum length of log_errors. In error_log information about the source is
; added. The default is 1024 and 0 allows to not apply any maximum length at all.
@@ -385,7 +443,7 @@
; Environment and Built-in variables (G, P, C, E & S respectively, often
; referred to as EGPCS or GPC). Registration is done from left to right, newer
; values override older values.
-variables_order = "EGPCS"
+variables_order = "GPCS"
; Whether or not to register the EGPCS variables as global variables. You may
; want to turn this off if you don't want to clutter your scripts' global scope
@@ -401,12 +459,12 @@
; Whether or not to register the old-style input arrays, HTTP_GET_VARS
; and friends. If you're not using them, it's recommended to turn them off,
; for performance reasons.
-register_long_arrays = On
+register_long_arrays = Off
; This directive tells PHP whether to declare the argv&argc variables (that
; would contain the GET information). If you don't use these variables, you
; should turn it off for increased performance.
-register_argc_argv = On
+register_argc_argv = Off
; When enabled, the SERVER and ENV variables are created when they're first
; used (Just In Time) instead of when the script starts. If these variables
@@ -422,7 +480,7 @@
;
; Magic quotes for incoming GET/POST/Cookie data.
-magic_quotes_gpc = On
+magic_quotes_gpc = Off
; Magic quotes for runtime-generated data, e.g. data from SQL, from exec(), etc.
magic_quotes_runtime = Off
@@ -550,7 +608,7 @@
[Date]
; Defines the default timezone used by the date functions
-;date.timezone =
+;date.timezone =
[Syslog]
; Whether or not to define the various syslog variables (e.g. $LOG_PID,
@@ -720,7 +778,7 @@
; Compatability mode with old versions of PHP 3.0.
; If on, this will cause PHP to automatically assign types to results according
; to their Sybase type, instead of treating them all as strings. This
-; compatibility mode will probably not stay around forever, so try applying
+; compatability mode will probably not stay around forever, so try applying
; whatever necessary changes to your code, and turn it off.
sybase.compatability_mode = Off
@@ -848,7 +906,7 @@
; on each request.
session.gc_probability = 1
-session.gc_divisor = 100
+session.gc_divisor = 1000
; After this number of seconds, stored data will be seen as 'garbage' and
; cleaned up by the garbage collection process.
@@ -868,7 +926,7 @@
; You can disable the feature and the warning separately. At this time,
; the warning is only displayed, if bug_compat_42 is enabled.
-session.bug_compat_42 = 1
+session.bug_compat_42 = 0
session.bug_compat_warn = 1
; Check HTTP Referer to invalidate externally stored URLs containing ids.
@@ -915,14 +973,14 @@
; 4 bits: 0-9, a-f
; 5 bits: 0-9, a-v
; 6 bits: 0-9, a-z, A-Z, "-", ","
-session.hash_bits_per_character = 4
+session.hash_bits_per_character = 5
; The URL rewriter will look for URLs in a defined set of HTML tags.
; form/fieldset are special; if you include them here, the rewriter will
; add a hidden <input> field with the info which is otherwise appended
; to URLs. If you want XHTML conformity, remove the form entry.
; Note that all valid entries require a "=", even if no value follows.
-url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=,fieldset="
+url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry"
[MSSQL]
; Allow or prevent persistent links.
@@ -1091,7 +1149,7 @@
; a gd image. The warning will then be displayed as notices
; disabled by default
;gd.jpeg_ignore_warning = 0
-
+
[exif]
; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.
; With mbstring support this will automatically be converted into the encoding