Php ini где лежит windows

Introduction

Understanding the location of the php.ini file is crucial for customizing PHP settings to optimize your web server. This file is the default configuration file for running applications that require PHP. It is used to control variables such as upload sizes, file timeouts, and resource limits.

Determining PHP Configuration Path

Before we proceed to exploring the locations in different operating systems, let’s understand how we can programmatically determine the location of the php.ini file using PHP code itself. You can use the phpinfo() function or php_ini_loaded_file() function as shown:

<?php
phpinfo();
// or
echo php_ini_loaded_file();
?>

This will return the path to the currently loaded php.ini file.

Windows

In Windows, the php.ini file is generally located in the same directory where your PHP is installed. For example:

C:\php\php.ini

If you are using WAMP, XAMPP, or a similar development environment, the location might differ:

C:\wamp64\bin\php\php[version]\php.ini
C:\xampp\php\php.ini

MacOS

On macOS, if you have installed PHP via Homebrew, the php.ini file is generally located at:

/usr/local/etc/php/[version]/

If PHP was installed as part of the MAMP package, it can usually be found under:

/Applications/MAMP/bin/php/php[version]/conf/php.ini

Ubuntu

On Ubuntu or other Debian-based systems, the file is generally situated in:

/etc/php/[version]/apache2/php.ini

If you’re running PHP with another SAPI like CLI or CGI, you might find the respective php.ini files under:

/etc/php/[version]/cli/php.ini

Editing the php.ini File

To edit the php.ini file, you can use any text editor. However, administrator privileges might be required. Here are some common adjustments:

// Increasing maximum upload size
upload_max_filesize = 100M
post_max_size = 100M

// Timezone
date.timezone = Europe/Berlin

// Maximum execution time
max_execution_time = 30

Advanced Tips

For advanced users, there are ways to set custom php.ini files for different projects. You can use the PHP_INI_SCAN_DIR environment variable to specify a directory that PHP will scan for additional ini files.

export PHP_INI_SCAN_DIR=/path/to/custom/ini/files

If you’re using different configurations for CLI and web server PHP, ensure to modify the correct ini file. It’s also possible to override php.ini settings at runtime using ini_set() in your PHP scripts:

<?php
ini_set('display_errors', '1');
?>

Alternative Configuration Methods

Other than editing the php.ini file directly, you can use ‘.user.ini’ files or Apache’s htaccess files for local configurations:

// .user.ini
upload_max_filesize = 100M
post_max_size = 100M

// .htaccess
php_value upload_max_filesize 100M
php_value post_max_size 100M

Remember that changes in php.ini require a web server restart to take effect.

Conclusion

Knowing where to find and how to edit the php.ini file is essential for PHP developers. Whether you’re adjusting your development environment on Windows, macOS, or Ubuntu, being able to quickly locate and configure PHP’s settings enables you to work on any platform with confidence. Always remember to reboot your PHP services after making changes in order for them to apply.

The php.ini file, a critical configuration file containing your web server’s PHP settings, is integral to the functioning of your website.

Each time PHP initiates, your system hunts down this file to identify directives that will be applied to your site’s scripts. While your PHP initialization file comes pre-configured, there may be instances when you need to tweak the default settings to meet your specific requirements, such as modifying the memory limit or maximum execution time for scripts to run on your environment.

Website malware can impact the php.ini file, particularly on servers running older versions of PHP. In the first six months of 2023 alone, our team remediated 30,658 compromised php.ini files from infected websites.

In today’s post, we’ll walk you through what this file is, where it’s located, how to modify this file to change your PHP settings, how it’s used by attackers to execute malicious code, and how to harden your site to prevent attacks.

Contents:

• What is the php.ini file
• Where is php.ini located?
• How can I change php.ini directives?
• What settings can I find in php.ini?
• Can malware affect the php.ini file?

What is the php.ini file?

The php.ini file, also referred to as PHP’s initialization file, is a crucial configuration file that governs your web server’s PHP settings. It allows you to manage your site’s PHP-specific regulations, such as defining the maximum size for file uploads, error displays, file timeouts, visibility of error messages, memory limits, and other server-management functionalities.

Картинка с сайта: blog.sucuri.net

By default, your server comes pre-configured with standard PHP settings. However, the php.ini file allows more customized control over these settings to optimize performance and enable certain functionalities.

The php.ini file is read by PHP during server start-up, however the location of your php.ini file may differ based on your server’s configuration, operating system, and PHP version.

We’ve provided a list below of some of the most common default locations for the php initialization file:

Default php.ini location for Linux

• /etc/php.ini
• /etc/php/X/apache2/php.ini (replace X with your PHP version)

Default php.ini location for Windows

• C:\php\php.ini
• C:\Windows\php.ini

How to locate the php.ini file via command line

If you’re comfortable with the command line interface, you can quickly locate your php.ini file using the ‘php –ini’ command.

Simply follow these instructions:

1. SSH onto your web server.
2. Type the following command:

php --ini | grep php.ini

1. Press enter.
2. A list of all actively used php.ini files along with their locations will be displayed.

Картинка с сайта: blog.sucuri.net

Check with your hosting provider

If you’re using a shared hosting plan, your access to php.ini may be restricted. You’ll need to contact your hosting provider for assistance identifying the location of the file and making any changes to it.

How can I change php.ini directives?

Even though default PHP settings are pre-installed on your server, you might need to create or edit a php.ini file to modify specific server settings. This can be accomplished by opening the file in your favorite text editor, modifying parameter values, saving them, and then restarting your web server to apply the changes.

Картинка с сайта: blog.sucuri.net

What settings can I find in the php.ini file?

There are a number of important settings, also referred to as php.ini directives, found in your PHP initialization file.

Let’s take a look at some of the most commonly used settings and analyze how they modify PHP’s behavior.

While this list is not exhaustive, you can get a jist for some common uses. For a more comprehensive list, check out the official documentation for php.ini directives.

Can malware affect the php.ini file?

Some website malware are known to affect PHP initialization files, especially on older web server configurations that allow site/directory level php.ini files. While it is not especially common these days, attackers are known to manipulate the behavior of PHP scripts by creating php.ini files with directives that facilitate malicious activity.

In the first six months of 2023 alone, our malware remediation team has already cleaned up 30,658 infected php.ini files. In most cases, we find multiple malicious files per site, as attackers often plant them in different directories on the environment.

For example, our teams frequently find the following php.ini file on compromised web servers.

safe_mode = Off
disable_functions = NONE
safe_mode_gid = OFF
open_basedir = OFF
exec = ON
shell_exec = ON

These directives help the attacker disable important security features that protect the server from malicious behavior. It’s worth noting that these directives may only give attackers advantages on older server configurations, but if you find them on your website it may be a leading indicator of compromise and a sign that other malware may be present on your website.

How to protect your web server

The moral of the story? Protect your web server by monitoring for indicators of compromise and unexpected changes in your environment (including new, unexpected php.ini files)!

There are a number of different layers of defense you can implement to protect your web server:

1 – Regularly update your PHP and other software

Always keep your operating system and server software patched and up-to-date to mitigate risk. While updating your software with the latest security patches doesn’t guarantee complete server security, it’s a crucial step as hackers are known to exploit unpatched servers, leading to ongoing incidents.

2 – Monitor your web server

All of your web server logs, including network services, website access, database server, and operating system logs, should be stored in a separate area, monitored frequently and checked for unusual entries, which could indicate potential or successful attacks. Any suspicious activity identified in the logs should be immediately investigated.

3 – Implement a file integrity monitoring system

Consider implementing file integrity monitoring to check for signs of tampering in your website, server, or configuration files. These useful tools check any changes against a previous version of the file and updates against set security rules, alerting you if any indicators of compromise are detected.

4 – Remove unnecessary services

Default operating system installations and configurations are often insecure due to the installation of many unnecessary network services, leaving more ports open for potential abuse by malicious users. To enhance security and server performance, switch off and disable all unnecessary services and make sure they don’t start automatically upon reboot. This will also help to free up hardware resources.

5 – Access your server through secure remote connections

Server administrators should ideally login to web servers locally. If remote access is required, it should be secured through encryption protocols, security tokens, and single sign-on tools, and restricted to specific IPs and accounts. Public computers and networks should be avoided for remote access due to security risks.

6 – Disable unused users

Stale or inactive user accounts can pose a significant security risk to your web server if left unchecked, as they could be used by an attacker. Consider regularly grooming your database for unused users and removing them if access is no longer required.

7 – Assign lowest privileges possible

The principle of least privilege — granting minimal system access necessary for an action and only for the necessary time — is key for securing your environment and effectively managing user roles to mitigate risk. Consider the lowest set of privileges necessary for tasks, how long they’re required, and ensure every user uses complex, unique passwords, thereby reducing potential vulnerabilities and limiting unauthorized actions.

8 – Get a web application firewall

Consider using a web application firewall to further harden your website and server, virtually patch known vulnerabilities, and mitigate bad bots and DDoS.

9 – Encrypt data in transit

Always use the latest secure communication methods like TLS v1.2 and AES encryptions for your web servers. Make sure to enable HTTPS for data encryption and validate your certificate(s) regularly.

And as always — if you think your website has been hacked or you’re struggling to fix an infection, we’d be happy to help clean up malware and restore your site!

In this tutorial, we’re going to discuss php.ini—the main configuration file in PHP. From the beginner’s perspective, we’ll discuss what it’s meant for, where to locate it, and a couple of important configuration settings it provides.

What Is php.ini?

Whether you’re a PHP beginner or a seasoned developer, I’m sure that you’ve heard of php.ini: the most important PHP configuration file. 

When PHP is run, it looks for the php.ini file in some specific locations and loads it. This file allows you to configure a few important settings that you should be aware of. Quite often, you’ll find you need to tweak settings in the php.ini file.

On the other hand, it’s certainly possible that you’ve never needed to modify php.ini. PHP can run happily with the settings provided in the default php.ini file, since PHP ships with these default recommended settings. In fact, there are no critical configuration parameters that you must set in order to run PHP. 

However, the php.ini file provides a couple of important settings that you want to make yourself familiar with. In fact, as a PHP developer, it’s inevitable, and you’ll encounter it sooner rather than later.

Where Is php.ini?

In this section, we’ll see how to find the php.ini file which is loaded when you run the PHP script. This can be tricky—the location of the php.ini file vastly varies by the environment you’re running PHP with. If you’re running Windows, you’ll likely find the php.ini file within the directory of your PHP installation in the system drive. On the other hand, if you’re running another operating system, then it’s difficult to guess the exact location of the php.ini file—there are several possibilities.

This is where the phpinfo() function comes to the rescue. It will tell you where php.ini is located, and it will also output all the important PHP configuration information. 

You can run phpinfo() by creating a .php file and calling that function. Go ahead and create the phpinfo.php file with the following contents and place it in your document root:

1

<?php

2

phpinfo();

3

?>

Load this file in your browser, and you should see the output of phpinfo(). Look for the following section.

Картинка с сайта: code.tutsplus.com

Картинка с сайта: code.tutsplus.com

As you can see, there are two sections. The first one, Configuration File (php.ini) Path, indicates the default path of the php.ini file in your system. And the second one, Loaded Configuration File, is the path from where the php.ini file is being loaded when PHP is run.

So you can edit the php.ini file indicated in the Loaded Configuration File section, and that should work in most cases. Of course, if you’re running PHP as an Apache module, you need to restart the Apache server to make sure that the changes you’ve made in the php.ini file are reflected.

On the other hand, if you’re using software like WAMP or XAMPP to run your web development stack, it’s even easier to modify the php.ini file—you can directly access it via the WAMP or XAMPP UI.

In the next section, we’ll explore a couple of important settings in the php.ini file.

Important Settings in php.ini

The php.ini file provides a lot of configuration directives that allow you to modify various behaviors of PHP. In fact, when you open the php.ini file, you may get overwhelmed by the number of directives it provides. I’ll try to group them based on their behavior, and I hope it’ll be easy for you to understand.

Of course, we won’t go through each and every directive, but I’ll try to cover the most important ones. Let’s have a look at the types of directives that we’re going to discuss.

• error handling directives
• file upload directives
• security related directives
• session directives
• miscellaneous directives

Error Handling Directives

In this section, we’ll go through directives that are related to error handling and are useful for debugging during development.

display_errors

The display_errors directive allows you to control whether errors are displayed on the screen during script execution. You can set it to On if you want errors to be displayed on the screen and Off if you want to disable it. It’s important that you don’t ever enable this on a production site—it will slow your site down and could give hackers valuable clues to your site’s security vulnerabilities.

error_reporting

This directive allows you to set the error reporting level. Mostly, this directive works in conjunction with the display_errors directive. This directive can accept E_ALL, E_NOTICE, E_STRICT, and E_DEPRECATED constants.

You can set it to E_ALL if you want to display all types of errors like fatal errors, warnings, deprecated functions, etc. You can also combine the different values if you want to filter out specific errors. For example, if you want to display all errors except notices, you can set it to E_ALL & ~E_NOTICE.

error_log

On a production website, you need to make sure that PHP doesn’t display any errors to the client browser. Instead, you can log errors somewhere so that later on you can refer to them if something goes wrong with your site. The error_log directive allows you to set the name of the file where errors will be logged. You need to make sure that this file is writable by the web server user.

File Upload Directives

In this section, we’ll see a couple of important directives that allow you to enable file uploading capabilities in your PHP forms.

file_uploads

This is a boolean directive which allows you to enable HTTP file uploads. If you set it to On, you can use the file field in your forms and users will be able to upload files from their computer. On the other hand, if you set it to Off, file uploading is disabled altogether.

upload_max_filesize

If you have enabled the file upload feature on your website and you’re facing difficulties in uploading files, this is the directive you should check first. It allows you to set the maximum size of a file that can be uploaded.

By default, it’s set to 2MB, and thus users can’t upload files larger than 2MB. You can fine-tune this value as per your requirements—often you’ll want to increase this limit to allow larger file uploads.

post_max_size

This setting allows you to set the maximum size of the POST data in your forms. When a user submits a form with the POST method, the total POST data size should not exceed the value you’ve set in this directive.

This should be larger than the value you’ve set in the upload_max_filesize directive, since file uploads are handled with POST requests.

Security Directives

In this section, we’ll see a few important directives that are related to security.

allow_url_fopen

The allow_url_fopen directive is disabled by default. But when it’s enabled, it allows remote file inclusion in PHP file functions. This means that your PHP files can include code from other servers. Be wary about enabling this—if your code is subject to an injection attack, remote file inclusion will make it much easier for a malicious user to hijack your server.

allow_url_include

The allow_url_include directive is similar to the allow_url_fopen directive, but it enables remote file inclusion in include functions. It allows you to include remote files in the include, include_once, require, and require_once functions.

If you want to enable this directive, you need to make sure that you’ve enabled the allow_url_fopen directive as well.

Session Directives

Session management is one of the most important aspects when you’re working with PHP. In this section, we’ll go through a couple of important session directives.

session.name

The session.name directive allows you to set the name of the session cookie. By default, it is set to PHPSESSID, but you can change it to something else by using this directive.

session.auto_start

If you set the value of the session.auto_start directive to 1, the session module in PHP starts a session automatically on every request, and thus you don’t have to use the session_start function in your scripts.

session.cookie_lifetime

The session.cookie_lifetime directive allows you to set the lifetime of a session cookie. By default, it is set to 0 seconds, and it means that the session cookie is deleted when the browser is closed. This is a really useful setting which allows you to set up a «remember me» kind of functionality, allowing your users to pick up where they left off on your site.

Miscellaneous Directives

In this last section, we’ll see a couple of other directives that are important in the context of PHP script execution.

memory_limit

The memory_limit directive allows you to limit the maximum amount of memory a script is allowed to use.

You want to fine-tune this directive as per your requirements, and you should not set this too high to avoid memory outages on your server—poorly written or buggy scripts can eat up all the memory on your server if you let them!

max_execution_time

The max_execution_time directive sets the maximum amount of time a script is allowed to run before it is terminated. The default is 30 seconds, and you can increase it to a reasonable limit as per your requirements if you need to.

Similar to the memory_limit directive, you should not set this too high to avoid issues on your server.

max_input_time

The max_input_time directive allows you to set the maximum amount of time a script is allowed to parse incoming form data from a GET or POST.

If you have forms on your website that submit a large amount of data, you might like to increase the value of this directive.

Conclusion

It’s impossible to cover each and every directive within a single article, but I’ve tried to cover the important ones. Feel free to post your queries if you want to know about any specific directives, and I’ll be happy to help!

As a PHP developer, it’s important that you understand the different directives in the php.ini file, and that should help you to fine-tune your PHP configuration to your requirements.

The Best PHP Scripts on CodeCanyon

Explore thousands of the best and most useful PHP scripts ever created on CodeCanyon. With a low-cost one-time payment, you can purchase these high-quality WordPress themes and improve your website experience for you and your visitors.

Картинка с сайта: code.tutsplus.com

Картинка с сайта: code.tutsplus.com

Here are a few of the best-selling and up-and-coming PHP scripts available on CodeCanyon for 2020.