Enable php phar extension

Enable php phar extension

The behaviour of these functions is affected by settings in php.ini .

Filesystem and Streams Configuration Options

Name	Default	Changeable	Changelog
phar.readonly	«1»	PHP_INI_ALL
phar.require_hash	«1»	PHP_INI_ALL
phar.cache_list	«»	PHP_INI_SYSTEM

Here’s a short explanation of the configuration directives.

This option disables creation or modification of Phar archives using the phar stream or Phar object’s write support. This setting should always be enabled on production machines, as the phar extension’s convenient write support could allow straightforward creation of a php-based virus when coupled with other common security vulnerabilities.

Note:

This setting can only be unset in php.ini due to security reasons. If phar.readonly is disabled in php.ini, the user may enable phar.readonly in a script or disable it later. If phar.readonly is enabled in php.ini, a script may harmlessly «re-enable» the INI variable, but may not disable it.

This option will force all opened Phar archives to contain some kind of signature (currently MD5, SHA1, SHA256, SHA512 and OpenSSL are supported), and will refuse to process any Phar archive that does not contain a signature.

Note:

This setting can only be unset in php.ini. If phar.require_hash is disabled in php.ini, the user may enable phar.require_hash in a script or disable it later. If phar.require_hash is enabled in php.ini, a script may harmlessly «re-enable» the INI variable, but may not disable it.

This setting does not affect reading plain tar files with the PharData class.

phar.require_hash does not provide any security per se, it is merely a measure against running accidentially corrupted Phar archives, because anyone who would be able to tamper with the Phar could easily fix the signature afterwards.

Allows mapping phar archives to be pre-parsed at web server startup, providing a performance improvement that brings running files out of a phar archive very close to the speed of running those files from a traditional disk-based installation.

Example #1 phar.cache_list usage example

in php.ini (windows): phar.cache_list =C:\path\to\phar1.phar;C:\path\to\phar2.phar in php.ini (unix): phar.cache_list =/path/to/phar1.phar:/path/to/phar2.phar

Источник

linux — How do I install / enable the PHP phar extension?

I am trying to install Composer on my KnownHost VPS. When I run this command:

curl -sS https://getcomposer.org/installer | php Copy code

Some settings on your machine make Composer unable to work properly. Make sure that you fix the issues listed below and run this script again: The phar extension is missing. Install it or recompile php without --disable-phar Copy code

How do I install the phar extension? I am running PHP 5.4.22 on my VPS.

Answer

Solution:

You can modify your php.ini file to get this working. (Some hosts use a phprc file to enable different settings in PHP instead of php.ini. @jerrygarciuh On dreamhost, follow the directions here)

After you have added your php.ini/phprc file, add these lines to the file (just the first line if your server doesn’t use Suhosin for security):

extension = phar.so suhosin.executor.include.whitelist = phar Copy code

restart php if you need to (insert php version number with no decimals if different):

killall -9 php70.cgi Copy code

then check to make sure it is working:

php -m | grep Phar Copy code

Finish with the install of composer and you should be good to go.

Answer

Solution:

Mind to install phar extension for php.

apt-get install php-phar Copy code

Answer

Solution:

In the end I solved this by getting my host to rebuild PHP with PDO support.

Answer

Solution:

I got the same issue in Ubuntu 16.04. After wasting two hours, I came up with this solution:

1. First install your required PHP version: sudo apt install php7.2
2. Install the composer. curl -sS https://getcomposer.org/installer | sudo php — —install-dir=/usr/local/bin —filename=composer
3. Check whether the composer is working by simply typing composer

If the composer is working properly, you are good to go.

Share solution ↓

Additional Information:

Didn’t find the answer?

Our community is visited by hundreds of web development professionals every day. Ask your question and get a quick answer for free.

Similar questions

Find the answer in similar questions on our website.

Write quick answer

Do you know the answer to this question? Write a quick response to it. With your help, we will make our community stronger.

About the technologies asked in this question

PHP

PHP (from the English Hypertext Preprocessor — hypertext preprocessor) is a scripting programming language for developing web applications. Supported by most hosting providers, it is one of the most popular tools for creating dynamic websites. The PHP scripting language has gained wide popularity due to its processing speed, simplicity, cross-platform, functionality and distribution of source codes under its own license.
https://www.php.net/

Welcome to programmierfrage.com

programmierfrage.com is a question and answer site for professional web developers, programming enthusiasts and website builders. Site created and operated by the community. Together with you, we create a free library of detailed answers to any question on programming, web development, website creation and website administration.

Get answers to specific questions

Ask about the real problem you are facing. Describe in detail what you are doing and what you want to achieve.

Help Others Solve Their Issues

Our goal is to create a strong community in which everyone will support each other. If you find a question and know the answer to it, help others with your knowledge.

Источник

Php – How to install / enable the PHP phar extension

I am trying to install Composer on my KnownHost VPS. When I run this command:

curl -sS https://getcomposer.org/installer | php 

Some settings on your machine make Composer unable to work properly. Make sure that you fix the issues listed below and run this script again: The phar extension is missing. Install it or recompile php without --disable-phar 

How do I install the phar extension? I am running PHP 5.4.22 on my VPS.

Best Solution

You can modify your php.ini file to get this working. (Some hosts use a phprc file to enable different settings in PHP instead of php.ini. @jerrygarciuh On dreamhost, follow the directions here)

After you have added your php.ini/phprc file, add these lines to the file (just the first line if your server doesn’t use Suhosin for security):

extension = phar.so suhosin.executor.include.whitelist = phar 

restart php if you need to (insert php version number with no decimals if different):

then check to make sure it is working:

Finish with the install of composer and you should be good to go.

Related Solutions

Php – How to prevent SQL injection in PHP

The correct way to avoid SQL injection attacks, no matter which database you use, is to separate the data from SQL, so that data stays data and will never be interpreted as commands by the SQL parser. It is possible to create SQL statement with correctly formatted data parts, but if you don’t fully understand the details, you should always use prepared statements and parameterized queries. These are SQL statements that are sent to and parsed by the database server separately from any parameters. This way it is impossible for an attacker to inject malicious SQL.

You basically have two options to achieve this:

Using PDO (for any supported database driver):

 $stmt = $pdo->prepare('SELECT * FROM employees WHERE name = :name'); $stmt->execute([ 'name' => $name ]); foreach ($stmt as $row) < // Do something with $row >

 $stmt = $dbConnection->prepare('SELECT * FROM employees WHERE name = ?'); $stmt->bind_param('s', $name); // 's' specifies the variable type => 'string' $stmt->execute(); $result = $stmt->get_result(); while ($row = $result->fetch_assoc()) < // Do something with $row >

If you’re connecting to a database other than MySQL, there is a driver-specific second option that you can refer to (for example, pg_prepare() and pg_execute() for PostgreSQL). PDO is the universal option.

Correctly setting up the connection

Note that when using PDO to access a MySQL database real prepared statements are not used by default. To fix this you have to disable the emulation of prepared statements. An example of creating a connection using PDO is:

$dbConnection = new PDO('mysql:dbname=dbtest;host=127.0.0.1;charset=utf8', 'user', 'password'); $dbConnection->setAttribute(PDO::ATTR_EMULATE_PREPARES, false); $dbConnection->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); 

In the above example the error mode isn’t strictly necessary, but it is advised to add it. This way the script will not stop with a Fatal Error when something goes wrong. And it gives the developer the chance to catch any error(s) which are throw n as PDOException s.

What is mandatory, however, is the first setAttribute() line, which tells PDO to disable emulated prepared statements and use real prepared statements. This makes sure the statement and the values aren’t parsed by PHP before sending it to the MySQL server (giving a possible attacker no chance to inject malicious SQL).

Although you can set the charset in the options of the constructor, it’s important to note that ‘older’ versions of PHP (before 5.3.6) silently ignored the charset parameter in the DSN.

Explanation

The SQL statement you pass to prepare is parsed and compiled by the database server. By specifying parameters (either a ? or a named parameter like :name in the example above) you tell the database engine where you want to filter on. Then when you call execute , the prepared statement is combined with the parameter values you specify.

The important thing here is that the parameter values are combined with the compiled statement, not an SQL string. SQL injection works by tricking the script into including malicious strings when it creates SQL to send to the database. So by sending the actual SQL separately from the parameters, you limit the risk of ending up with something you didn’t intend.

Any parameters you send when using a prepared statement will just be treated as strings (although the database engine may do some optimization so parameters may end up as numbers too, of course). In the example above, if the $name variable contains ‘Sarah’; DELETE FROM employees the result would simply be a search for the string «‘Sarah’; DELETE FROM employees» , and you will not end up with an empty table.

Another benefit of using prepared statements is that if you execute the same statement many times in the same session it will only be parsed and compiled once, giving you some speed gains.

Oh, and since you asked about how to do it for an insert, here’s an example (using PDO):

$preparedStatement = $db->prepare('INSERT INTO table (column) VALUES (:column)'); $preparedStatement->execute([ 'column' => $unsafeValue ]); 

Can prepared statements be used for dynamic queries?

While you can still use prepared statements for the query parameters, the structure of the dynamic query itself cannot be parametrized and certain query features cannot be parametrized.

For these specific scenarios, the best thing to do is use a whitelist filter that restricts the possible values.

// Value whitelist // $dir can only be 'DESC', otherwise it will be 'ASC' if (empty($dir) || $dir !== 'DESC')

Bash – How to count all the lines of code in a directory recursively

find . -name '*.php' | xargs wc -l 

or (when file names include special characters such as spaces)

find . -name '*.php' | sed 's/.*/"&"/' | xargs wc -l 

The SLOCCount tool may help as well.

It will give an accurate source lines of code count for whatever hierarchy you point it at, as well as some additional stats.

Sorted output:

find . -name ‘*.php’ | xargs wc -l | sort -nr

Источник