Upgrading to PHP 5.2.6

[completeamateur]

I feel a bit lazy posting on here, but I'm trying to upgrade from PHP 4.something to PHP 5.2.6.  I tried using the windows installer to install php 5 which meant the bottom of my config file changed to this...

 

LoadModule php4_module php4apache2.dll

LoadModule dav_svn_module "C:/Program Files/Subversion/bin/mod_dav_svn.so"

LoadModule authz_svn_module "C:/Program Files/Subversion/bin/mod_authz_svn.so"

AddType application/x-httpd-php .php

 

#BEGIN PHP INSTALLER EDITS - REMOVE ONLY ON UNINSTALL

PHPIniDir "C:/Program Files/PHP/"

LoadModule php5_module "C:/Program Files/PHP/php5apache2.dll"

#END PHP INSTALLER EDITS - REMOVE ONLY ON UNINSTALL

 

After deleting the top line, phpinfo() tells me Im running PHP Version 5.2.6 but half my websites don't load and I don't know why.  Anyone any ideas what the problem could be?

 

Many thanks.

 

(Running apache 2.0)

[PFMaBiSmAd]

There are very few incompatible changes going from php4 to php5 (there is a section in the php documentation that lists the exact differences.) It is more likely that a php.ini configuration difference is causing your code to not work.

 

You would need to post one of your non-working scripts so that someone can see what it might be doing that is php configuration dependent. The most likely causes are short open tags and register_globals. Short open tags are against php.net recommendations and register_globals have been completely eliminated in upcoming php6.

 

Edit: Also turning on full php error_reporting(E_ALL) and setting display_errors on will get php to point out any errors that will help identify why your code is not working.

[completeamateur]

Thanks for the reply.

 

The scripts use global variables so maybe thats the problem.

 

What's the deal, do you have to use them as session variables nowadays?  Bit of a ball ache changing it all.

[PFMaBiSmAd]

Are your "global variables" register_globals, where same name program/post/get/cookie/session variables are "magically" cross-populated? If you are talking about something else, then please elaborate and show an example.

 

If you are talking about register_globals, they were turned off by default in php4.2 in the year 2002. That was a full six year ago. No new code, new books, new tutorials, or new hosting accounts should have been created after that point in time that used register_globals.

 

The reason why register_globals were turned off and have finally been eliminated in php6 is because they were the most serious security hole that has ever been deliberately added to a programming language. They allow external post/get/cookie data to set session and program variables, so a hacker can set these by simply putting a GET parameter on the end of the URL. All a hacker needs to know (or just try all the commonly used names) is the variable name. This allowed scripts that are expecting session and program variables to be safe and secure to be taken over.