Upgrade to Pro — share decks privately, control downloads, hide ads and more …

php.iniの話

Avatar for uzulla uzulla
December 03, 2016

 php.iniの話

builderscon tokyo 2016
20161203
uzulla

Avatar for uzulla

uzulla

December 03, 2016
Tweet

More Decks by uzulla

Other Decks in Programming

Transcript

  1. !!!!!! » Nullable types » Void return type » Iterable

    pseudo-type » Class constant visiblity modifiers » Square bracket syntax for list() and the ability to specify keys in list() » Catching multiple exceptions types
  2. mbؔ਺͸ɺѻ͏จࣈίʔυΛઃఆ͔Β൑அ͍ͯ͠Δ php > var_dump( ini_get("mbstring.internal_encoding")); string(5) "UTF-8" » ͔ͩΒɺ͖͞΄Ͳmb_strlen͕ਖ਼͘͠਺͑ΒΕͨ »

    mbstring.internal_encodingͱ͍͏Ωʔʹɺ "UTF-8"ͱ͍͏஋͕͸͍͍ͬͯ·͢ɻ ͜Ε͕php.iniͷઃఆͰ͢ɻ » ͜͏͍͏ઃఆ͕ɺʢ؀ڥʹΑΔ͕ʣΏ͏ʹ200ݸҎ্͋Δ
  3. ઃఆΛɺUTF-8͔Βม͑ͯΈΔ php > echo mb_strlen("͍͋͏͓͑"); 5 php > ini_set("mbstring.internal_encoding", "SJIS-win");

    php > echo mb_strlen("͍͋͏͓͑"); 8 » ͱ͍͏͜ͱͰɺ಺෦ॲཧΛSJIS-win(cp932)ʹ͢Δͱ… » ͦͷ৔͔ΒΤϥʔ΋ͳ͘ɺจࣈ਺͕ਖ਼͘͠Χ΢ϯτͰ͖ͳ͘ͳΔɻ
  4. PHP3.0ͷphp.ini-distʢൈਮʣ [PHP_3] engine = On ; enable PHP 3.0 parser

    short_open_tag = On ; allow the <? tag. otheʙ precision = 14 ; number of significant dʙ y2k_compliance = Off ; whether to be year 2000ʙ safe_mode = Off safe_mode_exec_dir = max_execution_time = 30 ; Maximum execution tiʙ memory_limit = 8388608 ; Maximum amount of meʙ error_reporting = 7
  5. PHP7ͷiniʢൈਮ [PHP] engine = On short_open_tag = Off precision =

    14 serialize_precision = 17 zend.enable_gc = On expose_php = On max_execution_time = 30 max_input_time = 60 memory_limit = 128M error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT
  6. ؀ڥͷࠩΛຒΊͯΔͷ͕SAPI » SAPI͕ɺ؀ڥͱPHPΤϯδϯͷؒͰͱΓͳ͍ͯ͠Δ » SAPIͷ͓ӄͰɺphpʢͰॻ͔ΕͨϓϩάϥϜʣ͸ » echo͢Ε͹ϒϥ΢βʹग़Δ » Τϥʔ͕ΤϥʔϩάʹͰΔ »

    $_POST΍$_FILEͰύϥϝλ͕ͱΕΔ » ແ৺Ͱηογϣϯ͕࢖͑Δʢ$_COOKIE౳ɺhttpϔομʣ » …ͱ͍ͬͨ͜ͱ͕ීวతʹѻ͑Δ
  7. [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization

    file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ུ engine = On expose_php = On max_execution_time = 30 max_input_time = 60
  8. Ͳ͜ʹ͋Δͷ͔! » /etc ҎԼΛ୳͢ » CLIͰ php --ini » phpinfo()

    ͷʮLoaded Configuration Fileʯͱ ʮAdditional .ini files parsedʯ » php_ini_loaded_file() ͱ php_ini_scanned_files();ͷฦ஋
  9. ௐ΂͍ͨॴʹίʔυૠೖ $info = php_ini_loaded_file().",\n"; $info .= php_ini_scanned_files(); error_log($info); // ϑΝΠϧʹग़ྗ

    ҎԼ݁Ռ /Users/uzulla/.phpenv/versions/7.0.1/etc/php.ini, /Users/uzulla/.phpenv/versions/7.0.1/etc/conf.d/xdebug.ini, /Users/uzulla/.phpenv/versions/7.0.1/etc/conf.d/my_special.ini
  10. » phpʹ͸error_log()ͱ͍͏ศརؔ਺͕͋Δ » error_log($info); » نఆͷΤϥʔϩάʹͰ·͢ » ʢͨͱ͑͹ɺapacheͷerror_logʹग़Δʣ » error_log($info,

    $filename); ͱϑΝΠϧ໊ࢦఆ΋Ͱ͖·͢ » ʮ௕͍ͱ੾ΓࣺͯΒΕΔͷͰɺͦͷ৔߹͸php.iniͰ log_errors_max_lenΛ;΍͠·͠ΐ͏ʯʮ͏ʔΜʯ
  11. » Config file scan directoryͱΑ͹Εɺ࠷ۙΑ͔ͭ͘ΘΕ͍ͯ·͢ » php --ini ౳Ͱ͠Β΂ΒΕ·͢(Scan for

    additional .ini files) » ༗ΔσΟϨΫτϦҎԼͷ *.ini ͕શ෦ಡ·Ε·͢ɺ/etc/php.ini ͱ ಉ౳ » ʮΠϯϑϥετϥΫνϟʔΞζίʔυʹͽͬͨΓ!ʯ » ʢphp.iniͷઃఆΛॻ͖׵͑Δͷʹɺsedͱ͔΋͏ͨ͘͠ͳ͍͔Β Ͷ…ʣ » ͳ͓ɺಉҰͷઃఆهड़͕͋ͬͨ৔߹ɺ্ॻ͖͞Ε·͢
  12. ϑΥʔϚοτʹ͍ͭͯ ; comment here [hoge] key = value key2 =

    "this is value2" key3 = On key4 = This is value4 ; ΫΦʔτ͸࣮͸ෆཁ
  13. ҎԼͷߦɺͲΕ͕ʮΤϥʔʯʂʁ k1 = 1 k2 = True k3 = On

    k4 = "On" k5 = text contain new line. k6 = text
  14. Ͳ͜Ͱ΋ઃఆͰ͖ͯศརͳphpͷઃఆ৔ॴࣄྫ » php.ini ΍ scan dirͷ.ini » httpd.conf ΍ nginx.conf

    » .htaccess ΍ .user.ini » ϢʔβʔϓϩάϥϜ಺ » ʮ͋Δؔ਺(౳)Λ࣮ߦ͢Δͱɺ҉໧ʹมΘΔʯ » ؀ڥม਺ɺWindowsͷϨδετϦ…etcetc
  15. ௐ΂ΔͨΊͷؔ਺ » phpinfo > লུ » ini_get > Α͔ͭ͘͏ »

    ini_get_all > ࢲ͸Α͔ͭ͘͏ » get_cfg_var > ໨త͕ҧ͏
  16. ini_get() » ini_get ( string $varname ) » ݱࡏͷઃఆΛҰͭऔಘͰ͖Δ »

    ⚠ࣦഊ࣌ʹ͸False͕ฦΔ » ⚠ฦ஋͸ʮStringʯͰ͋Δ
  17. // php.iniʢϑΝΠϧʣͰ͸ Off ͩͱ… short_open_tag = Off // ͜ͷΑ͏ʹۭจࣈ͕ฦͬͯ͘Δ php

    > var_dump(ini_get('short_open_tag')); string(0) "" » php.ini هड़ͷ··Ͱ͸ͳ͍ʢྫ֎΋͋Δʣ » มΘΔͷ͸ྑ͍͕ɺॳݟࡴ͠Ͱ͢ » ͳͥ On/Offɺtrue/falseɺ1/0 ౳Ͱͳ͍ͷ͔… » ʮࣗಈม׵ͷPHPͰ͢ɺ׳Ε·͠ΐ͏!ʯ
  18. php > var_dump( ini_get('upload_max_filesize')); string(4) "2M" » upload_max_filesize ͸هड़͕ͦͷ··Ͱ͖ͯ·͢ »

    upload_max_filesize ͷࢦఆʹ͸ɺK,M,GͳͲͷ୹ॖه๏͕࢖͑ͯਓ ͕ಡΈ΍͘͢Ͱ͖Δɻ » http://php.net/manual/ja/ faq.using.php#faq.using.shorthandbytes » ͔͜͠͠ΕʹΑͬͯҾ͖ى͜͞ΕΔ൵ܶʂ()
  19. php > echo ini_get('upload_max_filesize'); 2M // 2Mbyte = 2*1024*1024 if(

    1*1024*1024 > ini_get('upload_max_filesize') ) { die("plz more!!!"); } //-> plz more!! // ͋ΕΕΕʁ php > echo (int)"2M"; // "2M"Λ਺஋΁Ωϟετ 2 » ⚠օ͞Μ͝ଘ͡ɺ"2M" ͕ධՁͰ 2 ʹͳΔ҆ఆͷࣗಈม׵ » ͪͳΈʹɺ୹ॖه๏ΛόΠτʹม׵͢Δؔ਺͸ͳ͍ɻͳΜͰ΍… » ֤ࣗॻ͔͘ɺൿ఻ͷͨΕΛάάΓ·͠ΐ͏(෗ͬͯͳ͍͔֬ೝ΋)
  20. php > var_dump(ini_get_all()); array(233) { ["allow_url_fopen"]=> // Ωʔ໊ array(3) {

    ["global_value"]=> // άϩʔόϧͷ஋ʢʁʣ string(1) "1" ["local_value"]=> // ݱࡏͷ஋ string(1) "1" ["access"]=> // ΞΫηεϨϕϧ int(4) }
  21. php > var_dump(ini_get('upload_tmp_dir')); string(0) "" php > var_dump(ini_get_all(null, false)['upload_tmp_dir']); NULL

    // ಥવͷNULLʂʂ » ʮ໊લ͕ࣅͯΔ͚ͩͰɺೋͭؔ਺ͷฦ஋͕ಉ͡ͱ୭͕ݴͬͨʁʯ » ຊདྷ upload_tmp_dir ͸ɺ(php.netᐌ͘)σϑΥϧτ͕NULL » ini_getͷ΄͏͕ਖ਼͘͠(?)ͳ͍ » ܕΛҙࣝͨ͘͠ͳΓ·͢Ͷʂ
  22. ΈΜͳେ޷͖print_r͸… php > echo print_r("",1); // ͳʹ΋Ͱͳ͍ php > echo

    print_r(null,1); // ͳʹ΋Ͱͳ͍ php > echo print_r(true,1); // true͸1ʹͳΔ… 1 » ͜ͷΑ͏ʹprint_r͸ܕΛͩ͞ͳ͍ » ͠ܕͳ͍ͷͰɺผͷಓ۩͕ඞཁ
  23. meanwhile in php conference 2015... » PHP࡞ऀͷϥεϜε͕͖͍ͯͨ » ʮࣃϒϥγʯͰ༗໊ͳਓ »

    ϔλͳӳޠͰ͜ͷ݅Λ௚ૌ࣭໰ » ࡞ऀʮͦΕ͸ͦ͏͍͏΋ͷͩɺobΛ͔ͭ͑!ʯࢲʮ͸͍…"ʯ » PHPʹٹ͍͸ͳ͔ͬͨ » ࢲʹ৯͍Լ͕Δӳޠྗ΋ͳ͔ͬͨ(fin…)
  24. serialize() php > echo serialize(0); // i:0; php > echo

    serialize("false"); // s:5:"false"; php > echo serialize(false); // b:0; php > echo serialize(null); // N; » Ұจࣈ໨Ͱܕ͕Θ͔ͬͯศརʂ! » i:int, s:string, b:bool, N:null » օɺPHPͷγϦΞϥΠζܗࣜΛಡΉΑ͏ʹͳΓ·͢ʢΑͶʁʣ
  25. json_encode php > echo json_encode(""); // "" php > echo

    json_encode(null); // null php > echo json_encode(true); // true php > echo json_encode("true"); // "true" php > echo json_encode(1); // 1 php > echo json_encode("1"); // "1" » ܕ΋ɺͪΌΜͱΈΕ͹Θ͔Δ!
  26. ݸʑͰͳ͘ɺશ෦ͷઃఆΛݟ͍ͨ࣌͸ php > echo json_encode(ini_get_all(null,false), JSON_PRETTY_PRINT); { "allow_url_fopen": "1", "allow_url_include":

    "", "arg_separator.input": "&", » ݁ՌΛjson_encodeͰɺJSON_PRETTY_PRINT » ൺֱʹ΋ศརͰ͢ʢॏཁʣ!
  27. jsonͱdiffͰࡶʹൺֱ͢Δྫ! $ diff 56.json 7.json 26c25 < "date.timezone": "Asia\/Tokyo", ---

    > "date.timezone": "", 42c41 < "error_reporting": "-1", --- > "error_reporting": "22527", » ֤ࣗπʔϧΛద౰ʹ
  28. ini_set » ini_set ( string $varname , string $newvalue )

    » Ωʔͱ஋Ληοτ͠·͢ » ஋͸StringͰ͢ʢ஫ҙʣ » ⚠ฦ஋͸ʮมߋલͷ஋ʯͰ͢ʢ஫ҙʣ » ⚠ࣦഊ࣌͸FALSE͕ฦΓ·͢ʢ஫ҙʣ » ⚠ઃఆͰ͖ͳ͍΋ͷ΋͋Γ·͢(ޙड़)
  29. php > ini_set('mbstring.strict_detection', 'On'); php > var_dump(ini_get('mbstring.strict_detection')); string(2) "On" php

    > var_dump(mb_get_info()['strict_detection']); string(3) "Off" <-- !!?? » mbstring.strict_detectionͰ֬ೝ » boolܕͳͷͰɺphp.iniͰ͸"On"Λࢦఆ͢Δ » ͔͠͠ini_set ͸ɺ"On"Λਖ਼͘͠ड͚෇͚·ͤΜʂ!
  30. ࢿྉΛΈͯΈ·͠ΐ͏ » php.iniͰ͸ true/false,on/off, yes/no, none ͱࢦఆ͢Δ http://php.net/manual/ja/configuration.file.php ; ࿦ཧ஋͸ɺ࣍ͷ͍ͣΕ͔Ͱࢦఆ͠·͢

    ; true, on, yes ; ·ͨ͸ false, off, no, none » ͔͠͠ɺ"true"Λ͍ΕΔͱɺΦϑʹͳΔ…ͷ͕… » ·͕ͪ͑ͳ͚Ε͹Ͳ͏ͱ͍͏͜ͱ͸ͳ͍!
  31. CLI » /etc/php.ini౳ » ͋Δ͍͸-c /path/to/php.ini php.iniΛύεͰࢦఆ » ͋Δ͍͸/etc/php-cli.ini ͷઃஔ

    » ຊདྷͷphp.iniͷdirʹɺphp-{SAPI໊}.ini͕͋Δͱphp.iniʹ༏ ઌ͞ΕΔ
  32. mod_phpͷ௥ՃσΟϨΫςΟϒ » php_value key value ͱStringͷઃఆ͕Մೳ » php_admin_value ಉ্͕ͩɺϢʔβ͕ઃఆ্ॻ͖Ͱ͖ͳ͘ͳΔ »

    php_flag key on ͱBoolͷઃఆ͕Մೳ » php_admin_flag ಉ্͕ͩɺϢʔβ͕ઃఆ্ॻ͖Ͱ͖ͳ͘ͳΔ
  33. CGI » /etc/php.iniͳͲ » .user.ini » .htaccessͷphp_value౳ͷ୅༻ɺه๏͸php.iniͱಉ͡ » ಉҰDir͔ΒDocRoot·Ͱͷؒʹઃஔ͢Δ »

    Ұ౓ಡΉͱσϑΥϧτͰ̑෼Ωϟογϡ͞Ε·͢ » publicʹஔ͘=࿙Ӯʹ஫ҙʂʢ.htaccessΈ͍ͨʹ403ʹ͠Α͏ʣ
  34. σϑΥϧτมߋΛ֬ೝ͢Δ » php.netʹ͸ʮ෇࿥ʯͱ͍͏ʮ͜Εͦ͜ຊฤʯΈ͍ͨͳ৘ใ͕͋Δ » ͦ͜ΛͪΌΜͱνΣοΫ͢Ε͹ɺେମେৎ෉ » php -n -aͰiniΛϩʔυͤͣʹini_get_allΛಈ͔ͯ͠ɺࠩΛݟΔ »

    ͕ࠩ͋ͬͨΒɺద੾ʹຒΊΔiniΛॻ͘ // ϦϞʔτͱखݩΛ֬ೝ͢Δ༗໊ςΫɻ͕ͩɺલड़ͨ͠Α͏ʹ҆қʹcliͰ֬ೝ͢Δͷ͸͓קΊ͠ͳ͍ɻ diff <(php -r 'phpinfo();') <(~/.phpenv/versions/5.6.9/bin/php -r 'phpinfo();') diff <(php -r 'phpinfo();') <(ssh remote 'php -r "phpinfo();"') diff <(ssh remote1 'php -r "phpinfo();"') <(ssh remote2 'php -r "phpinfo();"')
  35. log_errors = On ; ͦ΋ͦ΋ΤϥʔϩάΛऔΔ͔ error_reporting = E_ALL & ~E_DEPRECATED

    & ~E_STRICT display_errors = Off ; ը໘ʹΤϥʔΛग़͔͢ display_startup_errors = Off ; PHPͷىಈγʔέϯεʹ͓͍ͯൃੜͨ͠ΤϥʔΛը໘ʹग़͔͢ log_errors_max_len = 1024 ; Τϥʔϩάͷ࠷௕ʢ੾Γࣺͯ error_log = ; ग़ྗઌɺলུ࣌SAPI΁ html_errors = On ; SAPI΁ग़ྗ࣌ɺΤϥʔจࣈྻΛhtmlԽ͢Δ͔
  36. » error_reporting ʹεΠονࢦఆ͢Δ » දݱ͸਺஋͕ͩɺఆ਺ͷϏοτԋࢉͰࢦఆͰ͖Δ » PHPer͕།ҰϏοτԋࢉΛ͢Δ৔Ͱ͢ʢʁʣ » ྫ E_ALL

    & ~E_DEPRECATED & ~E_STRICT » = 22527 ɺ֮͑ΒΕΔ͔ʂ(ͳͷͰbitԋࢉ) » શ෦ͷΤϥʔ͔Βɺඇਪ঑ΤϥʔͱɺStrictΤϥʔΛൈ͍ͯΔ » ఆ਺ͳͷͰ*.ini΍ini_setҎ֎Ͱ͸͜ͷه๏͸͔ͭ͑ͳ͍ » ʮԿ΋ߟ͑ͣɺ-1 ʹ͓͚ͯ͠͹Φοέʔʯʢݸਓͷײ૝Ͱ͢ʣ
  37. » ⚠error_log͸ɺphp.iniͰࢦఆ͠ͳ͍΄͏͕͍͍ » ⚠Builtin server΍CLIͰը໘ʹΤϥʔͰͯ͜ͳ͘ͳΓ·͢(᠘) » SAPIଆͷphp_value౳Ͱઃఆ͢Δͷ͕ྑ͍Ͱ͠ΐ͏ » (͋Δ͍͸ɺہॴini_set͕Α͍͔ͱ) php

    > echo ini_get("error_log"); /tmp/php_errors.log php > echo $a; // ະఆٛม਺Λ৮͍ͬͯΔͷͰɺΤϥʔ͕ͰΔ͸͕ͣͩग़ͳ͍ php > ^D $ tail /tmp/php_errors.log [XXXX] PHP Notice: Undefined variable: a in php shell code on line 1
  38. » ϩάϩʔςʔγϣϯͱ͔ɺແ͍ɻ // init.dͰɺ؀ڥม਺ࢦఆͰɺޙ͸࠶ىಈͰ…ʂʁ export D_OF_WEEK=`date +%w` rm -f /path/to/php_errorlog.$D_OF_WEEK

    // php.ini error_log = php_errorlog.${D_OF_WEEK} - ʢδϣʔΫͰ͢ʣ - ૉ௚ʹlogrotateઃఆͯ͠࠶ىಈͨ͠΄͏͕ປ͕ߴ͍Ͱ͢ - ύΠϓͰ͖ͳ͍ͷͰɺ rotatelogsͱ͔͸࢖͑͵
  39. -1

  40. » error_reporting = -1 ͕࠷ڧ! » ʢલड़ͷ௨Γ੔਺ͳͷͰʣ֬ೝ͠΍͍͢͠ » ʮ͔͠͠ݱ࣮ੈք͸ਏ͍ۤ͘͠"ʯ »

    E_NOTICE͕མͱͯ͋ͬͨ͠ΒɺղΓ΍͍͢ةݥϑϥά » <s>ෆՄආͳίʔυ͸ɺͦ͜Ͱ͚ͩerror_reportingΛม͑ͨΓ@Λ ͚ͭΑ͏ɺ΍ͬͺΓPHP͸ศར</s>
  41. date.timezone ·ΘΓ date.timezone = "Asia/Tokyo" ;date.default_latitude = 31.7667 ;date.default_longitude =

    35.2333 ;date.sunrise_zenith = 90.583333 ;date.sunset_zenith = 90.583333
  42. ༨ஊɿṖͷҢ౓ܦ౓ ;date.default_latitude = 31.7667 ;date.default_longitude = 35.2333 ;date.sunrise_zenith = 90.583333

    ;date.sunset_zenith = 90.583333 » ʮdate_sunrise() ͱ date_sunset() ͰͷΈ࢖༻͞Ε·͢ɻʯ » ͳΜͱద੾ʹઃఆ͢Δ͜ͱͰ೔ͷग़ͱ೔ͷೖΓΛܭࢉͰ͖·͢ʂ » php.iniʹ࣋ͭඞཁ͕͋ΔͷͩΖ͏͔…ਂԕͳΔཧ༝͕͋Γͦ͏ʂ
  43. ৭ʑ͋Δ͚Ͳɺେ఍͜ΕͰΑ͍✅ default_charset = "UTF-8" ; Content-Type ͷσϑΥϧτ internal_encoding = "UTF-8"

    [mbstring] mbstring.language = Japanese mbstring.internal_encoding = "UTF-8" mbstring.strict_detection = On
  44. ༨ஊ(ʁ)ʮdefault_charsetͱ͸Ұମ…ʯ ; Use of this INI entry is deprecated, use

    global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = » ʮmbstring.internal_encodingͱ͔࣌୅஗Εɺ ࣌୅͸default_charsetҰՕॴͰ͓̺!!!ʯ » ࢲʮ΁ʔͦ͏ͳΜͩʯ
  45. » ʮʢdefault_charset͸ʣ mbstring.internal_encoding ͕ະઃఆ ͷ৔߹ͷσϑΥϧτͱͯ͠΋༻͍ΒΕ·͢ʯ » ΁ʔɺ͍͢͝ɺָͰ͍͍Ͷʂ » ͕ʂ࢒೦ʂ »

    SJIS-win͸ɺೖΕͯ΋൓ө͞Εͳ͍ʂʢίϝϯτʹ΋ॻ͍ͯ͋Δʣ » eucJP-win΋μϝͬΆ͍ʂ » UTF-8ͳΒɺͦ΋ͦ΋σϑΥϧτ΍Ζ͕͍ » ʮ…·ɺੲͳ͕Βʹઃఆ͠·͢Θɺ৴༻Ұ൪ʯ
  46. » max_input_time » ʮεΫϦϓτ͕ POSTɺGET ͳͲͷೖྗΛ ύʔε͢Δ࠷େͷ࣌ؒΛɺ ඵ୯ҐͰࢦఆ͠·͢ɻ ͜Ε͸ɺαʔόʔଆͰ PHP

    ͕ىಈ͔ͯ͠Βε ΫϦϓτͷ࣮ߦΛ։࢝͢Δ·Ͱͷ࣌ؒͰ͢ɻʯ » Α͘Θ͔ΒΜͶʁਖ਼௚Զ΋Α͘Θ͔ΒΜ » େ఍͜Ε͸΋ͬͱ΁Βͤ·͢ » ʮ͜ΕηΩϡϦςΟͳͷʁʯʮ͏ʔΜ…͍ΕΔॴ͕…ʯ
  47. » max_input_vars = 1000 » POST΍GETͷΫΤϦύϥϝλͷ࠷େ਺ » 1000Λଟ͍ͱΈΔ͔গͳ͍ͱΈΔ͔ɺਓʹΑ༷ͬͯʑͰ͠ΐ͏ɺͲ ͏Ͱ͔͢ʁ »

    1000ͰͨΓͳ͍͜ͱ͸͋Δʢਅإʣ » ओʹDoSରࡦ͕ϕʔεʢϋογϡίϦδϣϯ߈ܸͱ͔ʣ » ௒͑ΔͱʁWARN͕Ͱͯɺ੾ΓࣺͯΒΕͯɺ࣮ߦ͸ਐߦ͢Δʢ஫ҙʣ
  48. » open_basedir = /var/www/html:/tmp » phpίʔυ্͔Β͸ࢦఆ͞Εͨpathͷ֎ΛಡΈॻ͖Ͱ͖ͳ͍Α͏ʹ » ʮ҆શͦ͏ͩʂ͜Ε͸PHPքͷSELinux͔ʂ!ʯ » ʢͭ·Γɺ͙͢ʹΦϑʹ͞Ε·͢ʣ

    » ʢ͔͠΋ɺPHP_INI_ALLͰ͢ʣ » ෳ਺ࢦఆ࣌͸PathΛ:Ͱͭͳ͙͕ɺWinͷ৔߹͸;Ͱͭͳ͙ » Ұจࣈͷ୅ΘΓʹɺ௕͍PATH_SEPARATORఆ਺Λ͔ͭ͑͹ղܾ
  49. » allow_url_fopen = On » $html = file_get_contents('https://example.com/'); » ΛڐՄ͢Δ͔

    » ڐՄ͠·͠ΐ͏! » ʢ͜Ε͕Ͱ͖ͳ͔ͬͨΒͳͥPHPΛ͔͍ͭͬͯΔͷ͔ٙ໰Λ๊͍ͯ͠ ·͏…ʣ
  50. » allow_url_include = Off » require ('http://example.com/super_lib.php'); » ΛڐՄ͢Δ͔ɻ »

    ʮϠόͳ͍ʁ!ʯʮωοτ͔ΒίʔυDLͱ͔Ҿ͘Θ"ʯ » curl https://hoge/installer.sh | bash ͬͯ΍ͬͨ͜ͱ͕ͳ͍ਓ͸ͦ͏ݴͬͯ΋ྑ͍ » Ͱ΋·͊ɺແ͍Θʔ
  51. » sql.safe_mode = Off » ʮ໊લ͔Βͯͭ͠Αͦ͏ʂ!ʯ » ͔͠͠ʮPHPͰ͍͏ͱ͜Ζͷsafe_modeʯͱ͍͏ҙຯͰ͋Γɺผʹ safeͰ͸ͳ͍" »

    ʮΦϯʹ͢ΔͱɺσϑΥϧτ஋͕ࢦఆ͞Ε͍ͯΔσʔλϕʔε઀ଓؔ ਺͸ɺ Ҿ਺Ͱࢦఆ͞Εͨ஋ΑΓ΋σϑΥϧτ஋Λ༏ઌͯ͠࢖༻͠· ͢ɻ ʯ » ʢphpʹ͓͚Δʮsafe modeʯͱ͸ɺϢʔβʔͷϙΧʢ΍ѱҙʣΛଟ গअຐ͢Δͱ͍͏ҙຯͰ͢ʣ
  52. » expose_php = On » X-Powered-By: PHP/7.0.9 ͳͲΛӅ͢ » ·͋Φϑʹ͍ͨ͠ਓ͸Φϑʹͨ͠΄͏͕ΑΖ͍͠

    » ʢϔομʔʹPHP͔͍ͬͯͯ͋Δͱ͏Ε͍͔͠Β൱ఆͮ͠Β͍ʣ » ෭࡞༻ͱͯ͠ɺʮΠʔελʔΤοάʯ͕͔ͭ͑ͳ͘ͳΓ·͢
  53. » ΋͸΍ςϯϓϨɺSessionͰCookieΛ࢖͏֤छઃఆ session.use_cookies = 1 ; SIDΛCookie͔ΒಡΊΔΑ͏ʹ session.use_only_cookies = 1

    ; ͍·Ͳ͖URLʹຒΊࠐ·ͳ͍ͷͰɺOn session.name = PHPSESSID ; CookieΩʔ໊ session.cookie_secure = 1 ; httpsͰͷΈηογϣϯͷCookieΛ΍ΓͱΓ session.cookie_domain = ; ະࢦఆͰݱࡏͷυϝΠϯʹͳΔͷͰɺ௨ৗෆཁ session.cookie_path = / ; ηογϣϯΫοΩʔͷPath session.cookie_httponly = 1 ; SIDΛJS͔Βݟ͑ͳ͘͢Δ session.use_strict_mode = 1 ; SIDΛ஫ೖͤ͞ͳ͍
  54. session.cookie_lifetime = 0 ; ηογϣϯΫοΩʔͷExpireΛࢦఆ » 0͸ϒϥ΢βΛด͡Δ·Ͱ༗ޮ » ʢݱ୅Ͱʮϒϥ΢βΛด͡Δʯͱ͸…ʁʣ »

    sessionΛҡ࣋͢Δʹ͸ɺద੾ʹઃఆ͢Δ » ʮࠓ͔ΒNඵʯ » ผ్ɺετϨʔδͷlifetimeͷઃఆ΋͍Δʢޙड़ʣ » ʮ௕͔͋͘͞Δ΂͠ʯͷٞ࿦͸͜͜Ͱ͸͠ͳ͍
  55. ηογϣϯIDͷੜ੒खஈؔ܎ » ηΩϡϦςΟʹίμϫϦ͕͋ΔͳΒม͑ͯ΋Α͍ͷͰ͸ » มߋ͢Δͱɺݱࡏͷશηογϣϯ͕ফ͑·͢ʢ౰ͨΓલ͕ͩ…ʣ session.hash_function = 1 ; ηογϣϯͷϥϯμϜจࣈͷ௕͞

    ; 0:md5͔1:sha1͔ࢦఆͰ͖Δɺ͚Ͳ7.1Ͱফ͑·ͨ͠ session.entropy_length = 32 ; PHP 7.1Ͱফ͑·ͨ͠ session.entropy_file = /dev/urandom ; PHP 7.1Ͱফ͑·ͨ͠
  56. ͳ͓ɺphp7.1͸͜ͷΑ͏ʹγϯϓϧʹͳͬͨ » php.iniͷσϑΥϧτͩͱޙํޓ׵ੑͷͨΊʹ26จࣈʹͳ͍ͬͯΔ ͕ɺ΋ͬͱͷ͹ͨ͠΄͏͕͍͍ͧͱ͍͏͜ͱΒ͍͠ɻ ; Shorter length than default is

    supported only for compatibility reason. ; Users should use 32 or more chars. ; Default Value: 32 ; Development Value: 26 ; Production Value: 26 session.sid_length = 26
  57. session.save_handler = files ; σϑΥϧτͷfileετϨʔδΛ࢖͏ session.save_path = "/tmp" ; fileετϨʔδͷઃఆͰɺͲ͜ʹ৘ใΛอଘ͢Δ͔

    » session.save_pathʹ͸ηογϣϯ৘ใ͕อଘ͞ΕͨେྔͷϑΝΠϧ ͕Ͱ͖Δ » अຐͩͱ͔ɺCronͰ૟আ͞Εͳ͍Α͏ʹͱ͔ɺnfsͰڞ༗͍ͨ͠ ͱ͔(ݹ)ɺඞཁ͕͋Ε͹มߋ͢Δ » ʢύʔϛογϣϯʹ஫ҙʂʣ » ʮPHPҎ֎ͰɺηογϣϯϑΝΠϧΛࣗલͰಡΈॻ͖͢ΔʯͳͲ ͱ͍ͬͨɺڧ·ͬͨΞϓϦΛॻ͘ͳΒ͜ͷpathΛ֬ೝ͢Δ
  58. » $_SESSIONΛγϦΞϥΠζ͢ΔϋϯυϥΛࢦఆ » ʮมߋ͢Δͷʁڧ͍Ͷʙʯ session.serialize_handler = php ; $_SESSIONΛԿͰγϦΞϥΠζ͢Δ͔ ;

    ଞʹphp_serializeͳͲ͕͋Δ ;session.lazy_write = On ; 7͔Βɺߋ৽͕͋Δ৔߹ͷΈॻ͖ࠐΉࣄͰੑೳ޲্ » ղͬͯΔਓ͚͕͍ͩ͡Δ߲໨Ͱ͢
  59. » ηογϣϯͷ༗ޮظؒؔ࿈ » gc_maxlifetimeɺσϑΥϧτͷ24෼͸୹͍Α͏ͳɺ௕͍Α͏ͳ… session.gc_maxlifetime = 1440 ; ηογϣϯ༗ޮظؒɺඵ ;

    ΞΫηεຖʹgc_probability/gc_divisorͷαΠίϩΛৼΓɺ ; ֬཰తʹsessionͷGCཁٻ͕ߦΘΕΔ session.gc_probability = 1 session.gc_divisor = 1000
  60. » ݬͷػೳɺupload_progress ;session.upload_progress.enabled = On ;session.upload_progress.cleanup = On ;session.upload_progress.prefix =

    "upload_progress_" ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ;session.upload_progress.freq = "1%" ;session.upload_progress.min_freq = "1" » ͳΜͱʮϑΝΠϧΞοϓϩʔυͷϓϩάϨεόʔʯΛग़ͤΔ » ΞοϓϩʔυதʹผͷϦΫΤετΛඈ͹ͯ͠ɺηογϣϯΛݟΔͱɺ ਺஋͕औΕΔ » ਅ໘໨ʹ͔ͭͬͨ͜ͱ͸ͳ͍
  61. » ʮͳΜͱʂදʹೋճొ৔͠·͢ʂʯ » ͖ͬͱॏཁ͔ͩΒͳΜͰ͠ΐ͏ʂ » ʢ͔ͭͬͨ͜ͱͳ͍ʣ » ʮ·ͨɺPHP 7.1.0 Ͱ࡟আ͞Ε·ͨ͠ɻʯ

    » ʮ͑ʁphp.iniϑΝΠϧʹ࢒ͬͯΔΜ͚ͩͲ…ʯʢini_get͸Ͱ͖·ͤ ΜͰͨ͠ʣ » ʢ㙽ʹ֯·͋ɺͦΜͳ͔͍͋ͭͩͱ͍͏͜ͱͰ͢Ͷʣ
  62. ; -1 ίϯύΠϧ࣌ແࢹɺ0 ࣮ߦ͠ͳ͍ɺ1 ࣮ߦ͢Δ zend.assertions = -1 ;assert.exception =

    On ; fail࣌ྫ֎(ʁ)εϩʔ ; ͜ΕҎԼ͸ԼҐޓ׵ੑͷͨΊ࢒͍ͬͯΔ͕ɺ͔ͭ͏ͳͱ ;assert.active = On ;assert.warning = On ;assert.bail = Off ;assert.callback = 0 ;assert.quiet_eval = 0
  63. curl.cainfo=/path/to/cacert.pem » SSL certificate problem: unable to get local issuer

    certificateΈ͍ͨͳΤϥʔ͕ग़ͨΒରԠ » ূ໌ॻ͸ݕূͯͦ͜͠ɺCURLOPT_SSL_VERIFYPEERΛfalseʹ͢Δͱ͔ μϝઈର » cacert.pem͸https://curl.haxx.se/ca/cacert.pemͳͲ͔Βೖख
  64. DB