How to Customize PHP Flag Settings Without Using Apache and Htaccess

I recently purchased a web hosting account and tried to move my old website to the new server. At first I was a bit perturbed when I couldn't access anything - every file on the server resulted in an "Internal Server Error 500."

I narrowed the problem down to the .htaccess file - when I renamed it, everything worked fine. I assumed that there was an error with the way .htaccess was using modrewrite to change the URLs of my pages.

Turned out it was something far simpler. When I eventually commented out the line

"php_flag register_globals Off"

everything worked fine. Why did it do this?

PHP Can Be Run Through Apache or CGI

Often, PHP is run as an Apache module. Many web hosts, including my old web host, use this set up. A single php.ini file is created for the system, and individual users can tailor the settings with the .htaccess file.

It is possible, though, to run PHP as a CGI executable. In this case, Apache has nothing to do with PHP - so putting a "php_flag" line in the .htaccess file will yield the internal server error. If you want to change any settings in PHP, you'll have to find another way to do it.

Why Would I Want to Alter the php.ini Settings?

There are a number of settings in the php.ini file that you shouldn't have on. For some reason, web hosts leave them on by default and open your page to security holes and inefficiencies.

For security purposes, "register_globals" should be off. This helps prevent some hacking attempts, whereby a user can send his or her own variables to a user.

For consistency and performance, it helps to turn off "magic_quotes_gpc." This setting automatically escapes certain characters so that they're ready to go into a database - but not every piece of form information is intended to go into a database.

You may also want to customize the maximum file upload size, the level of output buffering, and other niceties.

Ok, Then How Do I Do It?

Simple. You create your own php.ini file.

If PHP is launched as a CGI executable, you've got two simple methods to get PHP working the way you want it.

The first method is to find the PHP executable. This will usually be in the /cgi-bin folder is PHP is being executed by CGI. If you place a php.ini file here, PHP will use it for your site instead of the server-wide php.ini file.

The second method is to put a php.ini file in your root folder and use .htaccess to point to the root folder. It is important to point to the folder, not the file itself. Once the php.ini file is created, place this line in your .htaccess file...

SetEnv PHPRC /path/to/root/folder

Umm... What Do I Put In the php.ini File?

That's a good question. Honestly, I couldn't tell you half of it.

That's why the creators of PHP are generous enough to make one for you. On the php.net website, you can find a pre-fab php.ini file.

There are actually two basic options - one is designed for development purposes, and one has been streamlined for more efficient and secure use. You should use the streamlined version (called "recommended") and tailor any specific settings to your liking.

You can find the latest copy of this recommended php.ini file, along with documentation for most of the settings, at php.net.

Alternatively, you could ask your web host for a copy of their php.ini file and you could change the settings that you don't like.

Either way, good luck with your new web host. Don't let this cause you a headache like it did to me. The solution, once you figure it out, is really quite simple.