PHP开发日志 ━━ IIS7安装PHP8.0及多个版本如何同时存在一台服务器-白红宇

PHP开发日志 ━━ IIS7安装PHP8.0及多个版本如何同时存在一台服务器

阅读量：4116 次

发布时间：2019-05-25

本文共 3644 字，大约阅读时间需要 12 分钟。

一、准备工作

1、安装运行库

php8和php5、php6、php7都需要安装对应版本的 Microsoft Visual C++运行库，左侧说明里有运行库下载路径：

VC15 & VS16
More recent versions of PHP are built with VC15 or VS16 (Visual Studio 2017 or 2019 compiler respectively) and include improvements in performance and stability.
-The VC15 and VS16 builds require to have the Visual C++ Redistributable for Visual Studio 2015-2019 or installed

php8下载标题（本文发表时） VS16 x64 Non Thread Safe (2020-Nov-24 22:43:38)，注意vs16字样

php7下载标题（本文发表时） VC15 x64 Non Thread Safe (2020-Nov-24 15:08:39)，注意vc15字样

安装运行库并且重启服务器

如果标题类似 php-5.3.4-Win32-VC6-x86.zip，那就意味着需要安装vc6运行库，去微软官网找吧。

2、解压缩php

将下载好的php8压缩包解压后放置于相关目录。个人经验建议创建类似这样的目录c:/php/php8.0，下次升级php的时候可以再建目录c:/php/php8.3，这样切换php相对而言比较清晰。

二、配置PHP

定义时区

date.timezone = Asia/Shanghai

extension_dir = "c:\php\php8.0\ext"

激活扩展，根据业务需求去掉;注释标记即可

extension=curlextension=gdextension=mbstringextension=mysqliextension=opensslextension=pdo_mysql

session存储目录
可以不用设置。在老版本的php中，可能因为原生目录权限问题而出错。

session.save_path = "d:\temp\phpSession"

安全设置
cgi.fix_pathinfo = 0、fastcgi.impersonate = 1、cgi.force_redirect = 0、expose_php = Off
可以看一下原文，更好理解这四个设置的作用。

; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI.  PHP's; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok; what PATH_INFO is.  For more information on PATH_INFO, see the cgi specs.  Setting; this to 1 will cause PHP CGI to fix its paths to conform to the spec.  A setting; of zero causes PHP to behave as before.  Default is 1.  You should fix your scripts; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.; http://php.net/cgi.fix-pathinfocgi.fix_pathinfo = 0; FastCGI under IIS supports the ability to impersonate; security tokens of the calling client.  This allows IIS to define the; security context that the request runs under.  mod_fastcgi under Apache; does not currently support this feature (03/17/2002); Set to 1 if running under IIS.  Default is zero.; http://php.net/fastcgi.impersonatefastcgi.impersonate = 1; cgi.force_redirect is necessary to provide security running PHP as a CGI under; most web servers.  Left undefined, PHP turns this on by default.  You can; turn it off here AT YOUR OWN RISK; **You CAN safely turn this off for IIS, in fact, you MUST.**; http://php.net/cgi.force-redirectcgi.force_redirect = 0; Decides whether PHP may expose the fact that it is installed on the server; (e.g. by adding its signature to the Web server header).  It is no security; threat in any way, but it makes it possible to determine whether you use PHP; on your server or not.; http://php.net/expose-phpexpose_php = Off

以往都是设置cgi.fix_pathinfo = 1，但现在发现有重大漏洞，原因举例：

当访问www.xx.com/phpinfo.jpg/1.php这个URL时，$fastcgi_script_name会被设置“phpinfo.jpg/1.php”，然后构造成SCRIPT_FILENAME(绝对路径)传递给PHP CGI,如果开启了cgi.fix_pathinfo=1选项（这个默认值就是1，所以没有设置过就是开启），那么就会触发在PHP中的如下逻辑：
PHP会认为SCRIPT_FILENAME(绝对路径)是phpinfo.jpg，而1.php是PATH_INFO，所以就会phpinfo.jpg作为PHP文件来解析了.
也是一个逻辑问题，所以说我们只需要在正常的.jpg后面加/.php就可以成功的绕过解析

《》