I going through some of the exercises in Murach's PHP and MySQL 3rd Edition and running into an issue with Exercise 13-1 (Modify the Shopping Cart application). Timestamp if important: I had just did Step 6 of the exercise.

The Problem

When adding items to the cart when said item isn't already in the cart, it works fine. However, if the item is already in the cart and I add it again, then it throws this fatal error;

Fatal error: Uncaught TypeError: update_item(): Argument #1 ($cart) must be of type array, string given

The error states the issue is happening somewhere in my cart.php file, either something wrong with the add_item() function or the update_item() function or both.

If anyone has a moment to spare, could they look into my cart.php file ( https://pastebin.com/uZiRqREN ) for what could be fixed?

Curious to know what methods people use to store the database login credts and possibly also find out the best and most secure one.

• Hard coded into a .php file with php variables/array

• .txt, .ini or similar file that is parsed before making the db connection

• .env variables

Right now, I'm using the .ini one. So far so good but I assume env vars are more secure? What you guys go with?

Some of you may be going with the frameworks' way but that's not what I'm really talking about. It's more about the raw coding type beat.

I am trying to deploy a Laravel application, i am deploying with docker in a VPS, and serving under a reverse proxy.

The proxy has HTTPS, but my assets are being served under HTTP, causing the browser to display the message "Blocked loading mixed active content".

Does anyone know how to fix this issue?

Full repo: https://github.com/natanschneider/toskos

Hi, I need help with a problem with PHP. I have a website that uses PHP, and Aapanel to manage it. Usually everything was fine, but at some point an error occurred and the page became inaccessible.The website primarily needs to use multi-webserver hosting, NGINX.

I've attached the error message that came up.

PHP load status acquisition failed: Traceback (most recent call last): File "/www/server/panel/class/ajax.py", line 79, in GetPHPStatus result = public.request_php(version,uri,'') ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/www/server/panel/class/public/common.py", line 3671, in request_php result = p.load_url_public(uri, pdata, method) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/www/server/panel/class/panelPHP.py", line 603, in load_url_public fpm_sock = fcgi(env, content) ^^^^^^^^^^^^^^^^^^ File "/www/server/panel/class/fastcgiClient.py", line 279, in __call__ sock = self._getConnection() ^^^^^^^^^^^^^^^^^^^^^ File "/www/server/panel/class/fastcgiClient.py", line 327, in _getConnection sock.connect(self._connect) File "/www/server/panel/pyenv/lib/python3.12/site-packages/gevent/_socketcommon.py", line 590, in connect self._internal_connect(address) File "/www/server/panel/pyenv/lib/python3.12/site-packages/gevent/_socketcommon.py", line 655, in _internal_connect raise _SocketError(result, strerror(result)) FileNotFoundError: [Errno 2] No such file or directory

I can't find the error that caused the page, and right now I can't manipulate the section much, so as not to take it down completely, and it's been almost a week since it's been visible.

I have a common file that I use for a lot of portable things. One is to grab the username and password from the form on the page of the person logging in. That code is this:

function get_param($param_name)
{
    $param_value = "";
    if (isset($_POST[$param_name])) {
        $param_value = $_POST[$param_name];
    } elseif (isset($_GET[$param_name])) {
        $param_value = $_GET[$param_name];
    }
    return $param_value;
}

Then at the login script we check what we have. It always gives an error. Here's where we try to grab that username and password:

// Gather form posts
$username = (string)get_param("username");
$password = (string)get_param("password");

In the receiving script I have tried to echo the values with a quick "exit" so I could see the values, but nothing seems to come up.

Am I missing something really basic?

Just simply using file_get_contents on any URL is throwing the 500 internal server error by apache. The same goes to cURL. I'm using MAMP with php 8.3.30.

// Using
$response = file_get_contents("https://google.com");


// Using
$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, "https://google.com");
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);

$response = curl_exec($ch);

if (!curl_errno($ch)) {
   echo $response;
}

curl_close($ch);

I have literally tried every solution I could find on Google and given by the AI, nothing is working at all so I'm making this thread.

---

Here's everything that I tried:

1: The related php.ini config I have

allow_url_fopen = On
max_execution_time = 120
memory_limit = 256M

2: Error reporting options

ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);

nothing is printed, just apache's default 500 internal server error

3: Checked every single log files in the logs directory too, apache_error.log, php_error.log and the mysql and mamp log files, absolutely nothing is printed there.

4: Faked the user agent like

$opts = [
    "http" => [
        "method" => "GET",
        "header" => "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\r\n"
    ]
];

$context = stream_context_create($opts);
echo file_get_contents("https://google.com", false, $context);

doesn't work either.

I'm also sure the internal server error is not thrown from the site that I'm trying to get the contents from. The error page is from my apache. It doesn't even take time to process this request, it's instant.

I've never encounter this type of problem before. What on Earth is happening here? If I missed any configuration, please point.

And btw, I'm executing this from my localhost (laptop) and not a host or any server. Could that be the reason? I don't think I've had this problem a few years back tho.

Lets say this is my PHP project...

- my-online-store
   - index.php
   - about.php
   - vendor
   - items
      - get.php
      - add.php

And lets say my-online-store directory is in /home/john for example.

If my working directory in the terminal is /home/john/my-online-store and I run php index.php for example. The working directory for the index.php, about.php, all of the vendor/composer packages and any scripts in sub directories such as get.php and add.php will be /home/john/my-online-store and all will work.

If I run index.php from a different working directory such as the root directory using php /home/john/my-online-store/index.php the PHP code will crash since the working directory is / and when looking for other files using require or using file_get_contents will look at the wrong directory.

Should I be concerned of this. Should I write my PHP code to ensure it will get the right directories no matter what the working directory was when running index.php?

Looking for security feedback on my open-source PHP encrypted file packaging project

I'm developing Encryption-tool, an open-source PHP project for packaging, encrypting, transferring, and safely restoring files.

The project relies on established cryptographic primitives, including Argon2id for password-based key derivation and libsodium's XChaCha20-Poly1305-based APIs for authenticated encryption. I'm not proposing a new encryption algorithm or cipher mode; my focus is on the package format, safe integration of these primitives, reliable decryption, and secure file restoration.

I'm currently hardening the implementation ahead of a stable release, with particular attention to input validation, package integrity, malformed or corrupted files, error handling, and encryption/decryption tests

I'd appreciate constructive, technically specific feedback on the implementation, security assumptions, file-format design, and test coverage. I'm especially interested in potential weaknesses or edge cases I may have overlooked.

GitHub: https://github.com/ElmanCod110/Encryption-tool

I'm fed up with all the fake and false information about the PHP2Shell vulnerability. Do you have any idea what the vulnerability actually looks like, like a memory issue or a request handling problem, what exactly is it?

I ran apt update && apt upgrade but the php on my ubuntu 26.04.1 LTS is still in version 8.5.4

I think the fixed version is 8.5.12

More info-

Php 8.5.4 (cli) (built: oct 19 14:35) (NTS)

Zend Engine v4.5.4 with Zend OPcache v8.5.4

Hello,

I am patching some php code of some kind of DB web integration and the code is quite old. After giving it into phpstorm to check for problems, it showed dozens of syntax errors (mostly curly braces for accessing array elements, no big deal in changing them to squared ones) and whole functions that arent supported anymore. Mostly things as MYSQL_BOTH, MYSQL_NUM, etc. Is there a nice way to fix those issues, maybe even some kind of software, or do I need to manually rewrite those passages w/o the functions?

At work we are presently not using any CI/CD tools. I would like to set something up where when a user commits to development, the development environment gets updated. When things are pushed to the master branch, production gets updated.

what would be the best way to set this up?

<?php

declare(strict_types=1);

namespace PhpBenchmarks;

use SplQueue;
use SplStack;

const NUM_TEST_ITEMS = 100_000;
const DATA_SIZE = 32; // Bytes.

/**
 * Runs a benchmark and reports the elapsed time.
 */
function benchmark(string $label, callable $operation): void
{
    echo 'Testing ' . $label . ' ... ';

    $start = hrtime(true);

    $operation();

    $elapsed = hrtime(true) - $start;

    echo number_format(NUM_TEST_ITEMS)
        . ' items in '
        . number_format($elapsed / 1_000_000_000, 6)
        . " seconds.\n";
}

/**
 * Generates the benchmark data.
 *
 * @return list<string>
 */
function generateData(): array
{
    $data = [];

    for ($i = 0; $i < NUM_TEST_ITEMS; ++$i) {
        $data[] = random_bytes(DATA_SIZE);
    }

    return $data;
}

$data = generateData();

// Stack push.
benchmark('SplStack (Push)', static function () use ($data): void {
    $stack = new SplStack();

    foreach ($data as $item) {
        $stack->push($item);
    }
});

benchmark('Array (Push)', static function () use ($data): void {
    $array = [];

    foreach ($data as $item) {
        $array[] = $item;
    }
});

echo "\n";

// Stack pop.
benchmark('SplStack (Pop)', static function () use ($data): void {
    $stack = new SplStack();

    foreach ($data as $item) {
        $stack->push($item);
    }

    for ($i = 0; $i < NUM_TEST_ITEMS; ++$i) {
        $stack->pop();
    }
});

benchmark('Array (Pop)', static function () use ($data): void {
    $array = $data;

    for ($i = 0; $i < NUM_TEST_ITEMS; ++$i) {
        array_pop($array);
    }
});

echo "\n";

// Queue push.
benchmark('SplQueue (Push)', static function () use ($data): void {
    $queue = new SplQueue();

    foreach ($data as $item) {
        $queue->enqueue($item);
    }
});

benchmark('Array (Push)', static function () use ($data): void {
    $array = [];

    foreach ($data as $item) {
        $array[] = $item;
    }
});

echo "\n";

$queue = new SplQueue();

foreach ($data as $item) {
    $queue->enqueue($item);
}

// Queue dequeue.
benchmark('SplQueue (Dequeue)', static function () use ($queue): void {
    for ($i = 0; $i < NUM_TEST_ITEMS; ++$i) {
        $queue->dequeue();
    }
});

benchmark('Array (Shift)', static function () use ($data): void {
    $array = $data;

    for ($i = 0; $i < NUM_TEST_ITEMS; ++$i) {
        array_shift($array);
    }
});

benchmark('Array (Null + Head)', static function () use ($data): void {
    $array = $data;
    $head = 0;

    for ($i = 0; $i < NUM_TEST_ITEMS; ++$i) {
        $item = $array[$head];
        $array[$head] = null;
        ++$head;
    }
});

My results on PHP 8.5:

Testing SplStack (Push) ... 100,000 items in 0.005546 seconds.

Testing Array (Push) ... 100,000 items in 0.001904 seconds.

Testing SplStack (Pop) ... 100,000 items in 0.007191 seconds.

Testing Array (Pop) ... 100,000 items in 0.003424 seconds.

Testing SplQueue (Push) ... 100,000 items in 0.005190 seconds.

Testing Array (Push) ... 100,000 items in 0.001699 seconds.

Testing SplQueue (Dequeue) ... 100,000 items in 0.003384 seconds.

Testing Array (Shift) ... 100,000 items in 4.463150 seconds.

Testing Array (Null + Head) ... 100,000 items in 0.002862 seconds.

That last one is from my own implementation.

Is there any point in using these data structures over an array? Could these data structures be further optimized by the PHP devs?

So my friend and I are patching together an old student weather station and I have been tasked with handling the data. It comes from his teeny-tiny server on the station as frequently as every 2 seconds (clearly way too granular for weather data ...) and I am writing the webpage and data visualization. My vision is to poll his server every X minutes and build a data set from the responses, then manipulate the data to create appropriate reports and visualizations for any users.

I should emphasize ... this is play. Pure hobby work.

Most of the coding described above is I have done before. However, I have not set up a continuous polling script, let alone on a paid server (Bluehost, in this case).

So I am reading about php daemons, which sound like exactly the sort of thing I need, and seem quite simple, frankly ... but most of the examples I find seem to be run on desktops for short periods, rather than on web servers proper for, well, an unlimited time period.

My questions:

- Is this sort of use case appropriate for a php daemon?

- Are there impediments I should be aware of in trying to run this from the commercial server?

- Any pitfalls that I should be looking at?

I know that this is higher level ... I haven't written any code for the daemon yet besides playing around a bit on my localhost. Just making sure I am on the right general track before getting formally started.

Thank you for any insights.

I have a custom commerce app built on Symfony and just upgraded it to Symfony 8 recently.

it’s on a single hostname and has two mobile apps (store and separate admin iOS app).

It has been growing and while I want to scale it out, I’m also thinking of using separate hostnames now for the store and admin.

The admin has plans to grow as well, such as doing a full blown inventory management so I can support multiple warehouses, inventory transfers, etc… along with running marketing campaigns from it

How should I go about handling this?

Keep it a single app? Split the app? Share a kernel?

Should I move the API to a dedicated subdomain like api.example.com ?

Another reason to split is so that a compromised third party storefront script doesn’t affect my admin staff if they access the storefront.

Hi ,

I need advice on upgrading a legacy PHP application.

The application is currently running on:

• PHP 5.4.7

• Apache 2.4.3

• Windows Server

The application is quite old, and I'm trying to determine whether it is feasible to upgrade directly to PHP 8.x or if the effort required to remediate compatibility issues would make a full rewrite a better option.

I am looking for guidance on:

• How to assess the application's upgrade readiness

• Common compatibility issues when moving from PHP 5.4 to PHP 8.x

• Recommended upgrade path (incremental vs. direct migration)

• Tools or approaches to identify deprecated functions and libraries

• Criteria for deciding whether to upgrade or rebuild the application

Any advice or experience with similar legacy PHP migrations would be greatly appreciated.

Thanks.

I am not a programmer, apart from basic HTML. I run a not-for-profit web site (we do not have any monetization what-so-ever) that was written by myself initially (in HTML) and substantially updated a few years ago using PHP by someone who is no longer alive! The site is a relatively large one with nearly 10,000 directories and over 270,000 images.

Due to the PHP alert I have done some investigating and can see that I am running an outdated version of PHP, 7.0.33. Advice seems to be to update to a current version and apply a security patch.

Unfortunately I have no idea how to do this. Any advice would be gratefully received.

Hello everybody,

I need your help. Let's say I have a Mapper that receive data from a database. For eg.

class Mapper { ...
    public string $table;
    public string $targetClass;

    public function getArrayOfObjects($conditions) {
        $PDOStatement = $this->Database->select($this->table, $conditions);
        $array = $this->Database->fetchAll(PDO:FETCH_ASSOC);

        $returnArray = array();

        // Now I populate the object property, for eg.
        foreach ($array as $database_row) {
            $object = new $this->targetClass;

            $object->id = $database_row['id'];
            $object->publishedDate = new DateTime($database_row['published_date']);

            ....

            $returnArray[] = $object;
        }

        return $returnArray;
     }
}

class BooksMapper extends Mapper {
    function __construct() {
      $this->table "books";
      $this->targetClass = "\Books";
    }
}

This mapper aims to be a generic one, not only for Books. I know that "publishedDate" is a "book concept" but let's consider that the Mapper reads from a JSON file the structure of the object that it is going to map with database fields.
Now let's say that I use it like that.

$Database = new \Database($someDatabaseConfiguration);
$BooksMapper = new \BooksMapper($Database);
$BookArray = $BooksMapper->getArrayOfObjects(["activeBook" => true]);

foreach ($BookArray as $Book) {
print "Book ID: " . $Book->id;
}

The problem here is that PHPStan seems not to understand that $BookArray is an array of \Book, and so at level 8 it gives me an error on $Book->id.

How can I solve that?

Thank you for your help, and excuse me for my ignorance.

Long story short. A bunch of my websites are on a Hostinger-managed server. Hostinger issued a quick press release to say that they have mitigated the issue, but say the following about their managed hosting:

On managed hosting, the fix is built into the PHP version your site already runs, so the version number may not change. To check, open Hostinger dashboard → Websites → Dashboard → PHP Info. A Build Date of October 21, 2026 or later means your site has the fix.

Checking one of my sites, the build date is indeed 21 October 2026 - but I don't feel reassured as the version number remains 8.5.11. And yesterday I received an email from Netcraft (albeit possibly spam) saying that the server hosting my sites had a 'potentially vulnerable web application'.

After a bit of back-and-forth with their support bot, it responded:

You’re right. I have not answered the actual request.

Your request is: upgrade the managed PHP runtime to the upstream fixed release, such as PHP 8.5.12, restart the PHP processes, and provide confirmation that this was done. That is technically a possible approach, but it is a fleet-wide Hostinger engineering decision, not a maintenance action I can schedule from this chat. I also have no evidence that Hostinger has scheduled such a version-number upgrade.

The honest position is therefore:

Hostinger says its backported package is fixed when the Build Date is October 21, 2026 or later.

Aikido’s guidance supports your preference for the upstream fixed version as the clearest, independently recognizable remediation.

I cannot give you the stronger assurance you are asking for, namely that your server is running PHP 8.5.12, because Hostinger’s stated remediation deliberately leaves the visible version at 8.5.11.

I cannot schedule or promise a fleet-wide upgrade to 8.5.12 from here.

So your concern remains valid: the Build Date confirms Hostinger’s stated backport, but it does not satisfy your request for the upstream PHP release number to be updated.

Am I right to be concerned that the server may still be vulnerable?