A web site I am looking at has their php support using CGI and claim
that is for security.

Is this fact or fiction?

tia

..oO(user)

>A web site I am looking at has their php support using CGI and claim
>that is for security.
>
>Is this fact or fiction?

Fact. On a shared host using the PHP CGI binary makes it easier to have
all scripts executed under the name and with the access privileges of
their owners. With using the PHP server module usually all scripts run
under the same user name (e.g. "nobody"), which is a security problem.

The drawback of the CGI version is a little performance hit.

Micha

Post removed (X-No-Archive: yes)

Tom,

Thanks for the reply.

That's part of what I am trying to determine. I have all my development
systems using php without cgi. First I wanted to get some opinions as to
the correctness of using cgi. I believe they (ISP) will allow both ways.
I want to use cgi if it will help my site with security.

The next step is to determine what I will need to change to use cgi.



Tom wrote:

> On Wed, 30 May 2007 01:09:39 GMT, user wrote...
>
>>A web site I am looking at has their php support using CGI and claim
>>that is for security.
>>
>>Is this fact or fiction?
>>
>>tia
>
>
> Lots of web hosing services end up running multiple sites on there servers.
> There's probably a number of combinations to manage proper permissions,
> security, performance, etc. With their setup, the CGI route may be the best way
> to offer PHP to their customers. Are they requiring you to setup your PHP files
> any differently, or was your question just out of curiosity?
>
> Tom

Micha

Thanks for the reply.

Michael Fesser wrote:

> .oO(user)
>
>
>>A web site I am looking at has their php support using CGI and claim
>>that is for security.
>>
>>Is this fact or fiction?
>
>
> Fact. On a shared host using the PHP CGI binary makes it easier to have
> all scripts executed under the name and with the access privileges of
> their owners. With using the PHP server module usually all scripts run
> under the same user name (e.g. "nobody"), which is a security problem.
>
> The drawback of the CGI version is a little performance hit.
>
> Micha