php5 and mysql5

[casimedicos]

http://www.gophp5.org/

PHP 4 has served the web developer community for seven years now, and served it well. However, it also shows its age. Most of PHP 4's shortcomings have been addressed by PHP 5, released three years ago, but the transition from PHP 4 to PHP 5 has been slow for a number of reasons.

PHP developers cannot leverage PHP 5's full potential without dropping support for PHP 4, but PHP 4 is still installed on a majority of shared web hosts and users would then be forced to switch to a different application. Web hosts cannot upgrade their servers to PHP 5 without making it impossible for their users to run PHP 4-targeted web apps, and have no incentive to go to the effort of testing and deploying PHP 5 while most web apps are still compatible with PHP 4 and the PHP development team still provides maintenance support for PHP 4. The PHP development team, of course, can't drop maintenance support for PHP 4 while most web hosts still run PHP 4.

It is a dangerous cycle, and one that needs to be broken. The PHP developer community has decided that it is indeed now time to move forward, together. Therefore, the listed software projects have all agreed that effective February 5th, 2008, any new feature releases will have a minimum version requirement of at least PHP 5.2.0. Furthermore, the listed web hosts have agreed that effective February 5th, 2008, they will include PHP 5.2 (or a more recent version) in their service offer.

It is our belief that this will provide web hosts reason to upgrade and the PHP development team the ability to retire PHP 4 and focus efforts on PHP 5 and the forthcoming PHP 6, all without penalizing any existing project for being "first out of the gate".

[JasonD]

Might I suggest a possible method of operation.

First, Update your Reseller, and Hosting-Plans, so that there is no-longer a promise of PHP4, in the list of items included. Also double-check the "Fantastico DeLuxe" installer, to make sure the programs available are not PHP4 only versions.

Second, you should send out a "Migration Letter" to all users on "Server X". (Doing them one at a time.) State the issue, and give them the option of clicking on a link...
- "No, Please don't move me, I use php4, and this will hurt my operations."
- "Help, I am not sure if this move is safe for my websites."
- "Yes, Please move me, I only use php5, and this will not hurt my operations."

With each "OK", you migrate that users sites to one of the "PHP5-only" servers.

With each "NO", you migrate them to a server that will stay mixed "PHP4-PHP5".

With each "UNSURE", give them a "TEST", so they can see if this will be an issue. (Disable or Enable PHP5 in HTACCESS, or instruct them how to do that.)

Third, once we are all moved off that server, Clean-it, and set it up as one of the new "PHP5-only", or use it as the next migration machine, for "PHP4-PHP5", moves.

This may sound like a lot of work, but it will simplify things, and stop a lot of unwanted potential head-ache. You just stop offering the PHP4 service to all new customers, and with the migration, allow those who might not be prepared, the option to get prepared, in a more timely schedule.

The links could simply be a GET request, similar to this...

whbstatus.com/migration.php?client=1111111&site=www.somesite.com &choice=yes

In all respects, this is one of the most secure things that can be done, besides a mutual upgrade of MySQL, to make it 5 for 5.

[Alan B]

I'm not sure what your point is. PHP5 and PHP4 are both available on WHB servers. You can already choose to use PHP5 if you want. You can write all new scripts for PHP5, while old scripts can either be rewritten to use PHP5 or left to continue using default PHP4.

As for the inability to use new PHP5 features without dropping support for PHP4, that's not entirely true. There are packages available that check for PHP version and offer either additional features if PHP5 is available or reduced features if PHP4 is available. I recently deployed a script that uses the DOM features of PHP5. A also installed a publicly-available script that provides full DOM support if PHP5 is available, but which falls back to the older DOM XML if only PHP4 is available.

[casimedicos]

Originally Posted by Alan B

I'm not sure what your point is. PHP5 and PHP4 are both available on WHB servers. You can already choose to use PHP5 if you want. You can write all new scripts for PHP5, while old scripts can either be rewritten to use PHP5 or left to continue using default PHP4.

As for the inability to use new PHP5 features without dropping support for PHP4, that's not entirely true. There are packages available that check for PHP version and offer either additional features if PHP5 is available or reduced features if PHP4 is available. I recently deployed a script that uses the DOM features of PHP5. A also installed a publicly-available script that provides full DOM support if PHP5 is available, but which falls back to the older DOM XML if only PHP4 is available.

read
http://www.gophp5.org/
http://www.lamateporunyogur.net/arch...pujon-a-php-5/
http://5lineas.com/archivo/desarroll...rto-viva-php5/

and in my cpanel the phpinfo is php4

[JasonD]

The issue I have, is with the security of PHP4 just being present. I would be comforted, knowing that I am on a php5 only server. As opposed to having half my neighbors, running cpu-hogging, and easily exploitable software on the same server.

The convenience of running both, does not out-way the gain of running only one. (Running both, at the same time, because part of the code is php4 and part is php5 safe, is even worse. That is like saying that driving two big tractors side by side is better to carry one plow, instead of having one big plow.)

The added problem is that php4 will make php5 vulnerable to the same exploits. Though they have separate programs translating them, they operate across the same data. PHP5 may have limited access, but exploiting access from php4, will grant php5 access in the crash. (In the end, yes I have turned on php5, but php4 is still shadowing the code.)

I tried to install on of the auction tools, and because I had php5 enabled, it refused to run, and filled the screen with many errors, and logs, and mysql. Only because it tired to run, and about 90% of the code ran, thus corrupting the install/uninstall, and leaving junk all over.

There is a good chance that a lot of this chaos is coming from the fact that both processes are attempting to run, and just not completing 100%. As the scripts for creating accounts, seem to choke the processor and ram on the rs9 server, and they seemed to do the same on the milkeyway server, when I was there.

Most of these websites hosted here are being poked and scanned for exploits, I have seen it in my own logs. They are all looking for PHP4 software, judging by the directories they are attempting to open.

I was simply suggesting that, "If", this were to be done, I would take the following steps. (Seemed more like it was an announcement that I missed.)

[Alan B]

Originally Posted by casimedicos

read

That adds nothing. The first one simply reiterates the points that you pasted into your first post. I agree that PHP5 is better, but that article doesn't make the case for why PHP4 can't co-exist with PHP5 in a shared hosting environment. The other two are in a language that I don't read. and in my cpanel

Originally Posted by casimedicos

readthe phpinfo is php4

1. You could easily add phpinfo.php5 yourself. No big deal.
2. phpinfo shouldn't be left on the server, as it is a security risk. It should be used when testing is necessary, then removed.

[casimedicos]

i agree with jason d
it is a security risk as it is fantastico scripts (old scripts)

more information (in english, sorry the other was in spanish)
http://gophp5.org/

http://ken.therickards.com/2007/07/05/gophp5org/

GoPHP5.org

Filed under: Miscellany, Web, Cool, Drupal


How many people does it take to start a movement? I guess we’ll find out.

GoPHP5.org launched today, after a lot of hard work by Robert Douglass, Larry Garfield and Marc Delisle. I know that Larry has been evangelical about contacting web hosts and PHP projects for the last month.

The purpose is to coordinate the movement of Open Source Software (OSS) projects to the exclusive use of PHP 5. Why exclusive? Because there are some incompatibilities between PHP 4 and PHP 5, developers often write workarounds to cover both cases. And, in other cases, we have to avoid using functions that are PHP5-only. Frankly, that just doesn’t make much sense to me.

For me, the whole thing started in Sunnyvale, during Dries Buytaert’s “State of Drupal” talk at the last Drupal/OpenSourceCMS meeting. After his informal talk, there was open Q&A. And, since we were at Yahoo!, Rasmus Lerdorf was handling the microphone for the audience.

The two had a friendly exchange about why more OSS projects didn’t use PHP 5 (Drupal 5.1 and the upcoming 6.0 both run on PHP 4 and PHP 5). The basic answer, from Dries (as I recall it) was so many of our users rely on shared hosts and most shared hosts still only offer PHP 4. Now, pride in his work aside, Rasmus has a vested interest in getting people onto PHP 5 as a platform: if the developer community doesn’t use it, support for new features will fall off, and the proect will suffer. Dries discussed this right after the Sunnyvale conference. Rasmus also faces the challenge that the PHP working group can’t force people to drop PHP 4. The code is loose, and people can do as they like.

But there are great benefits to moving development to PHP 5 (especially if you like to pass data around using XML).

My position on the issue is simple, but its a complicated kind of simple.
I work for a large company where we use PHP 5.2 exclusively in production.
On my development machine, I code and test on PHP 5.1.6 (thanks to Marc Liyanage).
My web host (for this site) runs PHP 4.4.x
I develop and maintain a Drupal module
The company I work for runs Drupal and Joomla sites, and Jonah Braun is on our staff.

So one day Jonah was having a barbecue and we started talking about the PHP 4 / PHP 5 debate, and the role of Drupal and Joomla. We agreed, in theory, that the problem for both projects is this: If one declares a move to drop PHP 4 and the other doesn’t, the project risks losing users not based on quality, but simply based on the availability of PHP 5.

Now we work on different projects, but Jonah and I agree (I think) that your decision to select software should be based on the merits of the product, not forced restrictions. So we thought: Hey, if we both declare that we’re moving to PHP 5 on some arbitrary future date….

After that conversation, I sent a note to Larry (who I knew was working on cool PDO features for Drupal that, yup, require PHP 5), and he thought it sounded like a good idea. That exchange spawned this soon-to-be-infamous post to the Drupal development list.

Since then, thanks to Larry and Robert and everyone else who has commented on, worked on, or debated about the proposal, the GoPHP5.org movement has gathered steam and leaked out to the greater world.

And that’s a good thing.


----

http://www.lamateporunyogur.net/arch...pujon-a-php-5/
automatic translation
Behind the site (gophp5) are considerable programmers like Robert Douglass (Drupal), Marc Delisle (phpMyAdmin) or Jonah Braun (Joomla), which have put a deadline on 5 February 2008 (see reference to version 5.2) to developers have as a minimum requirement using version 5.2 of PHP.

This initiative aims to 'force' to hosting services, among others, to offer the new version because there are millions of users that need to use common applications such as phpMyAdmin or Drupal.

---
http://5lineas.com/archivo/desarroll...rto-viva-php5/
automatic translation

The change and continued growth around the world of programming sometimes contrasted with the inertia that can be seen when something works and those responsible for implementing the change feel insecure without apparent reasons. Such is the case with version 5 of the programming language PHP and resistance to move beyond the previous version. PHP4 leads in production 7 years, but is that PHP5 arrived substitute ago 3. The migration is taking place at a very slow pace, something that limits to developers, as they are unable to take advantage of the latest release (Reviewed in libertonia and zonaphp). For example, many hostings that offer 4 as default version and 5 as an option. And one is sure that has not changed digit.

So an important group of software based on PHP as Dries Buytaert, Robert Douglass (Drupal), Marc Delisle (phpMyAdmin), Jonah Braun (Joomla) and several others, supported the site GoPHP5. The proposal is that developers marked as a minimum requirement from 5 February 2008 version 5.2.0 of PHP (fixed at the date that is not chosen by chance). In this way, suppliers will be forced to adapt once and for all to changing times. Already a number of committed and confident that the list of scripts that have pointed to the proposal, among which are those Drupal, phpMyAdmin and symfony or Typo3, grow in the coming weeks.

[vdanen]

Also keep in mind that right now you can only use php5 via cgi. As my dad found out (and got a rather rude form email indicating he had to cut down on cpu usage or have his account terminated within 7 days), having the default php4 running under mod_php and php5 running as a cgi causes horrible inefficiencies when you want to use php5.

Performance penalties are *high* when using php as a cgi interpretter. Since php4 is now officially unsupported and php5 is stable and has been out for many years now, I would suggest that php5 become the default (and run under mod_php) and php4 become the non-standard cgi-based one.

Why penalize people with threats and account cutoffs because we choose to use the latest incarnation of php, but have to use it under inefficient circumstances? All of my sites use php5; I haven't had a use for php4 in over 2 years. It seems like WHB will cater to the "fogies" who insist on using deprecated php4 but penalizes (and threatens) those of us who wish to use the "latest and greatest"... no... wait... not even that... the "latest and more secure" php5.

Penalize the people who use php4 for crying out loud... they should be getting their act together and using php5. And I also suspect that out of all of those using php4, maybe only 5% actually *need* to be using php4 (and then I humbly suggest they have other severe issues because then they're obviously using very out-dated and old software that probably has a number of issues anyways).

When will be able to have php5 as a default? When php6 is out? I'd rather have it now and be able to take advantage of a) the security and b) the better performance (and, ahem, lighter load on the servers) by having php5 run under mod_php and php4 running as a cgi for the poor fools who still require it.

[mpyusko]

This is the WHB server's stats



This is my home development server's stats.



As you can see, the WHB server is quite behind in their updates. Apache 2 has been out for ages, MySQL 5 has been out for ages, Even their version of PHP5 is not current. (I won't even mention the kernel release b/c that is a bit more... complicated... to manage.)

I posted a little while ago about how the lifecycle of MySQL 4 is nearing an end. http://www.whbstatus.com/showpost.ph...14&postcount=4 I have not heard any response as to what their migration plan is for MySQL.

I'm glad they at least have PHP5 offered. Now when are they going to move to Apache 2.2.x?

I run Slackware 12 on my home servers, and I manage to stay up to date'ish :-) No RPM updates, or apt-get for me.

I try not to complain much as WHB serves me quite well and currently meets my needs. However, this particular topic is of importance to me since the CMS i use for my biggest site is making a push to PHP5, MySQL5, and Apache 2. For now they are backwards compatible, but plan to move forward especially with MySQL 5 once the support lifecyle for 4 is over.

[Matt R]

PHP5 has been around for over a year. New machines are going on Apache 2, we're basically waiting to see how these perform before we mass upgrade.