.PHP File Format – php.ini and SAPIs

Server APIs

A SAPI connects the PHP engine to whatever starts it. php_sapi_name() and the constant PHP_SAPI give its name.

Under a web SAPI each request normally runs a script from a clean state: variables, objects and included code are gone when the request ends.

How a web server picks PHP files

The file extension means nothing to PHP. It is the web server’s configuration that sends some names to PHP, and every other file is served as it is.

<FilesMatch \.php$>
    SetHandler application/x-httpd-php
</FilesMatch>

<FilesMatch "\.phps$">
    SetHandler application/x-httpd-php-source
</FilesMatch>

location ~* \.php$ {
    fastcgi_index   index.php;
    fastcgi_pass    127.0.0.1:9000;
    include         fastcgi_params;
    fastcgi_param   SCRIPT_FILENAME  $document_root$fastcgi_script_name;
}

• Use a pattern anchored to the end of the name. A looser rule, such as AddType, can make a name like exploit.php.jpg run as PHP.
• The .phps handler sends highlighted source to the browser. It should not be enabled on production systems.
• The manual advises setting cgi.fix_pathinfo=0 so that PHP does not run a different file from the one requested. PHP-FPM must never be reachable from an untrusted network, because a FastCGI client controls settings such as auto_prepend_file.
• A file without a handler is sent as plain text, so its source reaches the browser. Keep code outside the document root where possible.

The command line

The CLI reads the file named on the command line, or standard input. The shebang line of the script is skipped. It starts in quiet mode, with no HTTP headers, and does not change the working directory to the script’s directory.

The CLI overrides some settings so that scripts work well in a terminal. These cannot be set in php.ini, but can be changed by ini_set() at run time.

The constants STDIN, STDOUT and STDERR are open stream handles, available on the CLI only. $argc and $argv are always set on the CLI. Under a web SAPI the register_argc_argv setting can derive them from the query string, which is deprecated since PHP 8.5, so do not test for the CLI by looking for them. Test PHP_SAPI.

Settings that change how a file runs

The defaults below are the ones built in to PHP. The php.ini-production file shipped with PHP changes several of them (manual: list of directives).

OPcache

PHP compiles each file to bytecode (opcodes) before running it. The OPcache extension keeps that bytecode in shared memory, so that a file is not recompiled on each request. Since PHP 8.5 it is a non-optional part of PHP. There is no standard compiled file format: PHP normally distributes source, not bytecode.