PHP parameter Tuning

A basic introduction

PHP.ini suitable for nginx and Apache, such as php-fpm suitable for nginx+fastcgi configuration
php.ini PHP engine php.fpm PHP process
PHP configuration file consists of two, one is development, the other is production
Two differences:
Production scenario PHP.ini logs are either closed or exported to a file, so we turn off or hide non-program output in the production environment

Two php.ini parameter tuning

The closing and hiding of logs is the basic tuning of PHP

1 Open PHP's Safe mode

PHP security mode is the PHP embedded security mechanism, can control some PHP function execution, while many file operation functions to control permissions, if you call RM through PHP and delete some server resources, then security no longer exists

2 User Group Security

When Safe_mode is turned on, Safe_mode_gid is turned off, the PHP script can access the file, and the same group of users can access the file, the recommended setting is: Safe_mode_gid=off
If not set, it is possible that I am working on files under the Server Web site Directory

3 Close Danger function

For example, you can view PHP's version and basic information through phpinfo (), and then have an understanding of the system

4 closing PHP version information leaks in HTTP headers

5 Close Registered Global variables

Variables submitted in PHP, including those that use post or get commits, are automatically registered as global variables and can be accessed directly, which is very insecure for the server, and all we can't do is register the global variable with the option to shut down the registration global variable, which involves program development

6 open MAGIC_QUOTES_GPC to prevent SQL injection

SQL injection is very dangerous, the Web site is modified to the background, the entire server fell

SQL Injection Prevention:
Apache in Mod_security and mod_enasive
Nginx in Nginx Lua VAF

7 Error Message Control

General PHP is not connected to the database or other circumstances will be prompted error, the general error message will contain the PHP script current path information or query SQL statements and other information, which is not safe

If you want to read the log, you first need to set the level of the log

Set log open and provide a path

8 section resource parameter limit optimization 1 set the maximum time each script runs

When large files cannot be uploaded or background backup data often times out and needs to be adjusted, this parameter is the default

2 maximum memory used by each script

3 Maximum time each script waits to enter data

Where-1 means no limit

4 Maximum license size for uploaded files

9 section Security parameter Optimization 1 prohibit open remote address

2 setting Cgi.fix_pathinfo=0 to place nginx file type Error parsing vulnerability

10 Adjusting PHP Session information storage type and location

Default location

In general, the data is accessed again if the session is stored locally, access is invoked on another device, which results in a re-need to save the session again
The default is to save the file, generally need to modify the file to memcached

Build memcached

Path modified to the address of the memcached server

Restart Service

See if info exists

Two PHP-FPM1 pid

Turn on PID to manage with PID

2 Turn On Error log

3 Turn on log level

The number of 4 largest fpm fork processes. If the concurrency is large, you can open it up a bit.

5 Adjust the maximum number of open files

6 Users and groups, to be the same as nginx users and groups

7 Modify the Listening port and IP address

8 Process Related 1 default

Maximum number of processes

Number of START service processes

Number of service minimum processes, number of services when no traffic is available

Maximum number of spaces

2 modifications

modifying parameter results




Destroy time when the process is not in use

Number of service requests per child process

9 Access logs for PHP

10 slow query related log on

PHP parameter Tuning