PHP 代碼是運行在服務端的。如果在服務器上建立了如上例類似的代碼,則在運行該腳本后,客戶端就能接收到其結果,但他們無法得知其背后的代碼是如何運作的。但這樣一來也就讓一些技術高手有可乖之機,利用php注入到后臺,修改網站的的數據,甚至可以將 web 服務器設置成讓 PHP 來處理所有的 HTML 文件,這么一來,用戶就無法得知服務端到底做了什么。
PHP 5.5.7官方版發(fā)布原因
為了修復上一個版本所留下的漏洞,php發(fā)布了最新的版本PHP 5.5.7
PHP 5.5.7介紹
PHP 5.5.7/5.4.23/5.3.28緊急發(fā)布.2013-12-13.上個版本是2013-11-14的5.5.6/5.4.22。全部修正了一個 OpenSSL的安全漏洞(CVE-2013-6420)5.3本來已停止常規(guī)開發(fā)也更新了。 總共修正了10幾個Bug(包括Opcache的幾個Bug)及安全漏洞。
PHP 能夠在所有的主流操作系統上使用,包括 Linux、Unix 的各種變種(包括 HP-UX、Solaris 和 OpenBSD)、Microsoft Windows、Mac OS X、RISC OS 等。今天,PHP已經支持了大多數的 web 服務器,包括 Apache、Microsoft Internet Information Server(IIS)、Personal Web Server(PWS)、Netscape 以及 iPlant server、Oreilly Website Pro Server、Caudium、Xitami、OmniHTTPd 等。對于大多數的服務器,PHP 提供了一個模塊;還有一些 PHP 支持 CGI 標準,使得 PHP 能夠作為 CGI 處理器來工作。
PHP 5.5.7官方版修復內容
完全改進:
Version 5.5.7
12-Dec-2013
Core:
Fixed bug #66094 (unregister_tick_function tries to cast a Closure to a string).
Fixed bug #65969 (Chain assignment with T_LIST failure).
CLI server:
Added some MIME types to the CLI web server.
Implemented FR #65917 (getallheaders() is not supported by the built-in web server) - also implements apache_response_headers()
OPCache:
Fixed bug #66176 (Invalid constant substitution).
Fixed bug #65915 (Inconsistent results with require return value).
Fixed bug #65559 (Opcache: cache not cleared if changes occur while running).
readline:
Fixed bug #65714 (PHP cli forces the tty to cooked mode).
Openssl:
Fixed memory corruption in openssl_x509_parse() (CVE-2013-6420).
Version 5.4.23
12-Dec-2013
Core:
Fixed bug #66094 (unregister_tick_function tries to cast a Closure to a string).
Fixed bug #65947 (basename is no more working after fgetcsv in certain situation).
JSON:
Fixed whitespace part of #64874 ("json_decode handles whitespace and case-sensitivity incorrectly").
MySQLi:
Fixed bug #66043 (Segfault calling bind_param() on mysqli).
mysqlnd:
Fixed bug #66124 (mysqli under mysqlnd loses precision when bind_param with 'i').
Fixed bug #66141 (mysqlnd quote function is wrong with NO_BACKSLASH_ESCAPES after failed query).
OpenSSL:
Fixed memory corruption in openssl_x509_parse() (CVE-2013-6420). (Stefan Esser).
PDO:
Fixed bug #65946 (sql_parser permanently converts values bound to strings).
Version 5.3.28
12-Dec-2013
Openssl:
Fixed handling null bytes in subjectAltName (CVE-2013-4073).
Fixed memory corruption in openssl_x509_parse() (CVE-2013-6420). (Stefan Esser).
Version 5.6.4
18 Dec 2014
Core:
Fixed bug #68091 (Some Zend headers lack appropriate extern "C" blocks).
Fixed bug #68104 (Segfault while pre-evaluating a disabled function).
Fixed bug #68185 ("Inconsistent insteadof definition."- incorrectly triggered).
Fixed bug #68355 (Inconsistency in example php.ini comments).
Fixed bug #68370 ("unset($this)" can make the program crash).
Fixed bug #68422 (Incorrect argument reflection info for array_multisort()).
Fixed bug #68545 (NULL pointer dereference in unserialize.c).
Fixed bug #68446 (Array constant not accepted for array parameter default).
Fixed bug #68594 (Use after free vulnerability in unserialize()). (CVE-2014-8142)
Date:
Fixed day_of_week function as it could sometimes return negative values internally.
FPM:
Fixed bug #68381 (fpm_unix_init_main ignores log_level).
Fixed bug #68420 (listen=9000 listens to ipv6 localhost instead of all addresses).
Fixed bug #68421 (access.format='%R' doesn't log ipv6 address).
Fixed bug #68423 (PHP-FPM will no longer load all pools).
Fixed bug #68428 (listen.allowed_clients is IPv4 only).
Fixed bug #68452 (php-fpm man page is oudated).
Fixed request #68458 (Change pm.start_servers default warning to notice).
Fixed bug #68463 (listen.allowed_clients can silently result in no allowed access).
Fixed request #68391 (php-fpm conf files loading order).
Fixed bug #68478 (access.log don't use prefix).
Mcrypt:
Fixed possible read after end of buffer and use after free.
GMP:
Fixed bug #68419 (build error with gmp 4.1).
PDO_pgsql:
Fixed bug #67462 (PDO_PGSQL::beginTransaction() wrongly throws exception when not in transaction).
Fixed bug #68351 (PDO::PARAM_BOOL and ATTR_EMULATE_PREPARES misbehaving).
Session:
Fixed bug #68331 (Session custom storage callable functions not being called).
SOAP:
Fixed bug #68361 (Segmentation fault on SoapClient::__getTypes).
zlib:
Fixed bug #53829 (Compiling PHP with large file support will replace function gzopen by gzopen64).
- PC官方版
- 安卓官方手機版
- IOS官方手機版