{"id":832,"date":"2010-09-06T19:56:13","date_gmt":"2010-09-07T00:56:13","guid":{"rendered":"http:\/\/icesquare.com\/wordpress\/?p=832"},"modified":"2012-08-14T18:24:40","modified_gmt":"2012-08-14T23:24:40","slug":"think-twice-before-upgrading-your-server-to-php-5-3-3","status":"publish","type":"post","link":"https:\/\/icesquare.com\/wordpress\/think-twice-before-upgrading-your-server-to-php-5-3-3\/","title":{"rendered":"Think twice before upgrading your server to PHP 5.3.3"},"content":{"rendered":"

I upgraded to PHP 5.3.3 today, and I was shocked! I found a huge security hole<\/del> default setting change that may leak the source code to public, which never happened in the earlier version.<\/p>\n

Here is an example. Suppose my code looks like this:<\/p>\n

\r\n<?php\r\n\r\necho \"This is a good example\";\r\n\r\n?>\r\n<\/pre>\n
Everything will turn out fine. Here is the result:<\/p>\n
\"Good<\/a><\/p>\n
However, if the open tag is changed from <?php<\/span> to <?<\/span>:<\/p>\n
\r\n<?\r\n\r\n\/\/My comment\r\necho \"This is a bad example\";\r\n\r\n?>\r\n<\/pre>\n
Then PHP 5.3.3 will not recognize the code within the < ? and ?> tag. Instead, it will parse it as a regular text file, i.e., your users will see the code. Here is the result:
\n\"Bad<\/a><\/p>\n
I know that it happens on PHP for Windows (XAMPP for Windows), but I didn’t know that they move this new feature to Unix world.<\/p>\n
Update:
\nThanks for the help from bt garner, it is pretty simple to fill this security hole.<\/p>\n
First, open the php.ini. If you are not sure where is it, you can run the following command to locate it:<\/p>\n
\r\nsudo find \/ -name \"php.ini\"\r\n<\/pre>\n
And activate the following parameters:<\/p>\n
\r\nshort_open_tag = On\r\n<\/pre>\n
That’s it!<\/p>\n
–Derrick
\n<\/p>\n","protected":false},"excerpt":{"rendered":"
I upgraded to PHP 5.3.3 today, and I was shocked! I found a huge security hole default setting change that may leak the source code to public, which never happened Continue Reading →<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[94,144,6],"tags":[15,172],"class_list":["post-832","post","type-post","status-publish","format-standard","hentry","category-computer-problems-computer-help-pc-support","category-sever-problem","category-technology","tag-bug","tag-php"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/p1sqzr-dq","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":3134,"url":"https:\/\/icesquare.com\/wordpress\/php-network-error\/","url_meta":{"origin":832,"position":0},"title":"PHP Network Error","author":"Derrick","date":"February 21, 2013","format":false,"excerpt":"One of my PHP web applications stopped working today. After I investigated the issues, I noticed that this is a very famous, yet unsolved error. I have no idea why it happens, but I do have a work around solution for it. Basically, this article applies to you if you\u2026","rel":"","context":"In "Computer Problems"","block_context":{"text":"Computer Problems","link":"https:\/\/icesquare.com\/wordpress\/category\/technology\/computer-problems-computer-help-pc-support\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":3514,"url":"https:\/\/icesquare.com\/wordpress\/freebsdphp-does-not-work-after-upgrading-apache-to-2-2-27\/","url_meta":{"origin":832,"position":1},"title":"[FreeBSD]PHP does not work after upgrading Apache to 2.2.27","author":"Derrick","date":"April 11, 2014","format":false,"excerpt":"I upgraded the Apache to 2.2.27 on my FreeBSD box via portmaster. The upgrade went very smooth. After the upgrade, I found that Apache no longer rendered the PHP page correctly. In the other words, it displayed the source code of the PHP files instead of executing the code. Before\u2026","rel":"","context":"In "Computer Problems"","block_context":{"text":"Computer Problems","link":"https:\/\/icesquare.com\/wordpress\/category\/technology\/computer-problems-computer-help-pc-support\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2777,"url":"https:\/\/icesquare.com\/wordpress\/solvedproblem-to-update-openldap-in-freebsd\/","url_meta":{"origin":832,"position":2},"title":"[Solved]Problem to Update OpenLDAP in FreeBSD","author":"Derrick","date":"April 29, 2012","format":false,"excerpt":"Recently, I found the following error message when updating my FreeBSD system regarding to the OpenLDAP: ===> Installing for openldap-client-2.4.31 ===> Generating temporary packing list ===> Checking if net\/openldap24-client already installed ===> Creating users and\/or groups. Using existing group `ldap'. Creating user `ldap' with uid `389'. pw: user 'ldap' already\u2026","rel":"","context":"In "Computer Problems"","block_context":{"text":"Computer Problems","link":"https:\/\/icesquare.com\/wordpress\/category\/technology\/computer-problems-computer-help-pc-support\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":3925,"url":"https:\/\/icesquare.com\/wordpress\/freebsdupgrade-php-5-5-to-5-6\/","url_meta":{"origin":832,"position":3},"title":"[FreeBSD]Upgrade PHP 5.5 to 5.6","author":"Derrick","date":"February 20, 2015","format":false,"excerpt":"It is not easy to upgrade PHP 5.5 to 5.6 in FreeBSD. Without proper preparation, the upgrade process may drive you nut. Before you decide to get your hands wet, here are what I recommend you to do: Back up your files Test your website in a PHP 5.6 environment\u2026","rel":"","context":"In "Computer Problems"","block_context":{"text":"Computer Problems","link":"https:\/\/icesquare.com\/wordpress\/category\/technology\/computer-problems-computer-help-pc-support\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":3596,"url":"https:\/\/icesquare.com\/wordpress\/shared-object-libsqlite3-so-8-not-found\/","url_meta":{"origin":832,"position":4},"title":"Shared object “libsqlite3.so.8” not found","author":"Derrick","date":"July 1, 2014","format":false,"excerpt":"I noticed some weird thing on my server today. When I ran some PHP code, I got the following error: PHP Warning: PHP Startup: Unable to load dynamic library '\/usr\/local\/lib\/php\/20121212-zts\/pdo_sqlite.so' - Shared object \"libsqliteo_sqlite.so\" in Unknown on line 0 Warning: PHP Startup: Unable to load dynamic library '\/usr\/local\/lib\/php\/20121212-zts\/pdo_sqlite.so' - Shared\u2026","rel":"","context":"In "Computer Problems"","block_context":{"text":"Computer Problems","link":"https:\/\/icesquare.com\/wordpress\/category\/technology\/computer-problems-computer-help-pc-support\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2502,"url":"https:\/\/icesquare.com\/wordpress\/freebsdproblem-to-update-php-port\/","url_meta":{"origin":832,"position":5},"title":"[FreeBSD]Problem to update PHP port","author":"Derrick","date":"January 12, 2012","format":false,"excerpt":"A new version of PHP (5.3.9) was available in FreeBSD today. Since it contained a lot of security fixes and enhancements, I decided to give it a try. After testing the new PHP in couple test servers, I think it is ready to upgrade the PHP on the production server.\u2026","rel":"","context":"In "Computer Problems"","block_context":{"text":"Computer Problems","link":"https:\/\/icesquare.com\/wordpress\/category\/technology\/computer-problems-computer-help-pc-support\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/posts\/832","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/comments?post=832"}],"version-history":[{"count":19,"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/posts\/832\/revisions"}],"predecessor-version":[{"id":2895,"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/posts\/832\/revisions\/2895"}],"wp:attachment":[{"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/media?parent=832"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/categories?post=832"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/tags?post=832"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}