Can php.ini settings be overridden in by a website using PHP + IIS6?

Question

We have PHP 5.2.6 deployed to c:\php and in that folder there is the php.ini file. On Windows, can a website override these settings similar to the way that apache has .htaccess? e.g.

DirectoryIndex index.php index.html
<IfModule mod_php5.c>
php_flag magic_quotes_gpc off
  php_flag register_globals off
</IfModule>
<IfModule mod_php4.c>
  php_flag magic_quotes_gpc off
 php_flag register_globals off
</IfModule>

Update: Hi folks, thanks for the answers. I was aware of ini_set() but wondered if there was a declarative way to do this in a configuration file in the website rather than in script.

Thanks in advance
Kev

Answer 1

I would recommend doing all you can to avoid changing register_globals to on as it's a major security hole.

But you can try using init_set() to change the settings within your PHP code, although some settings cannot be changed once PHP has started running. (These are somewhat server dependent I believe.)

Answer 2

ini_set should do what you're after -

$option = 'magic_quotes_gpc';
echo "Value of $option => ", ini_get($option);
ini_set($option,0);
echo "New value of $option => ", ini_get($option);

A caveat here is that just because you can set the value at run-time doesn't mean it will work as expected, e.g. setting register_globals at runtime will be of little use as that setting has already done it's job by the time your script starts.

Answer 3

You can override the directives in the php.ini file several ways, but not all directives can be changed by each method. See the php.ini directives page in the manual for a list of the directives and the methods that will work on each one.

The last column in the table lists the methods that will work on that particular method. In increasing level of access:

• PHP_INI_USER - Can be set in user scripts with ini_set() (or any higher method)
• PHP_INI_PERDIR - Can be set using the .htacess file with php_value for string values or php_flag for binary values (or any higher method)
• PHP_INI_SYSTEM - Can be set using php.ini or httpd.conf only (both require access to the server's configuration files)
• PHP_INI_ALL - Can be set using any of the above methods

Answer 4

For cgi environments, there is a module called htscanner. It basically fakes .htaccess behavior and allows per directory configurations. Unfortunately I have no experience with this on Windows, let alone with IIS6.

Answer 5

From http://us.php.net/configuration.changes:

Changing PHP configuration via the Windows registry

When running PHP on Windows, the configuration values can be modified on a per-directory basis using the Windows registry. The configuration values are stored in the registry key HKLM\SOFTWARE\PHP\Per Directory Values, in the sub-keys corresponding to the path names. For example, configuration values for the directory c:\inetpub\wwwroot would be stored in the key HKLM\SOFTWARE\PHP\Per Directory Values\c\inetpub\wwwroot. The settings for the directory would be active for any script running from this directory or any subdirectory of it. The values under the key should have the name of the PHP configuration directive and the string value. PHP constants in the values are not parsed. However, only configuration values changeable in PHP_INI_USER can be set this way, PHP_INI_PERDIR values can not.

...Haven't actually tried this yet, so your mileage may vary.

Answer 6

I just found a new way of doing this. First of all, I used phpinfo() to find the PHP.ini being used by my Hosting provider.

Thereafter, I uploaded a file containing the following code to my Hosting space:

    $fsrc = fopen($pathToIni,'r');
    $fdest = fopen($myHostingDir,'w+');
    $len = stream_copy_to_stream($fsrc,$fdest);
    fclose($fsrc);
    fclose($fdest);
    echo $len;

This effectively copied the php.ini to my Hosting space. Thereafter, I downloaded that php.ini, changed the register_globals to off (for which I did all this), and uploaded it to the root of my Hosting space. Bingo, there you go.

I have relied on the fact that IIS uses the complete php.ini if available in a directory. You cannot override only specific settings like that using .htaccess on Apache.