View Single Post
  #2 (permalink)  
Old Mar 18th, 2004, 11:24
Webforumz Staff Webforumz Staff is offline
Most Reputable Member
Join Date: Jul 2003
Posts: 1,856
Thanks: 0
Thanked 0 Times in 0 Posts
Read the PHP documentation as I remember there may be one change you have to make in the php.ini file for some versions of PHP which can affect whether PHP will run or not.

If you are using this server for development then none of the other settings are strictly necessary. However, many people recognise a main security risk - declaring globals. By default when you install PHP you may use a variable in a script which has the same name as a POST or GET variable that has been sent to that script, without declaring as such in PHP. So basically if someone figures out what another variable name is in your code that controls something important, they could send it via GET or POST and change the outcome of your code - Thus, they find a potential security hole.

You can disable that (and I would certainly suggest it if you are using this installation as a server) but setting register_globals = Off in the php.ini file. This requires you to declare all your variables that are external, explicitly, like so:
$get_name = $HTTP_GET_VARS['get_name'];
$form_name = $HTTP_POST_VARS['form_name'];

That, I would say, is the most important change to make to your php.ini file. There are others... you can read through the php.ini file as it is heavily documented and therefore you can make changes based on that.

It should be mentioned, that if a script is not written to register globals, then it will not work if you turn register_globals on. It would be hoped that the script has declared it's variables anyway in this case - but that isn't always true, so be careful.

As for MySQL - You don't need to make any changes to anything in PHP. You simply use the windows installer and install MySQL. This installs the MySQL Service, which any programming language on your computer (and others on your network) can use. PHP, ASP, even C++ programs, etc can access a MySQL service. There is no configuration required from any of them to do this.