The challenge with securing a shared hosting server is how to secure the website from attack both from the outside and from the inside. PHP has built-in features to help, but ultimately it s the wrong place to address the problem.

I’ve already written about a number of solutions that work, but one option I’ve been asked time and time again to look at is using PHP + FastCGI. The belief is that using FastCGI will overcome the performance issues of Apache’s suexec or mod_suphp, because FastCGI processes persist between page views.

But before we can look at performance, the first question is: how exactly do we get PHP and FastCGI running as different users on the one web server in the first place?

Installing And Configuring mod_fcgid for Apache

Stock Apache does not ship with built-in support for FastCGI. You need to download and install a third-party module. There are two choices – the original mod_fastcgi, and the more recent mod_fcgid, which I’ll look at in this article. Before we start, make sure that you have built and configured Apache to use suexec. We will reuse suexec to ensure that our FastCGI PHP processes run as different users.

Most Linux distributions already include a package for mod_fcgid; you should be able to install it using your distro’s package manage. The version I’ve tested for this article is mod_fcgid 2.2 running on Seed Linux (a Gentoo-based distro).

After installing mod_fcgid, make sure that you edit your Apache config files, and comment out any lines that load mod_php. They will look like this:

LoadModule php5_module modules/

Then, add the following lines to your virtual host.

SuexecUserGroup myuser mygroup

<Directory /var/www/localhost/htdocs>
AddHandler fcgid-script .php
Options ExecCGI
Allow from all
FCGIWrapper /var/www/localhost/cgi-bin/php.fcgi .php

Replace “myuser” with the user who owns the website, and replace “mygroup” with the group that the user belongs to. This sets the privileges that PHP will run as when this website is visited.

Because suexec is understandably paranoid about what CGI programs it will run for you, to make mod_fcgid work in a shared hosting environment, we need to create a FastCGI wrapper script owned by the same user that owns the website:

export PHPRC
exec /usr/lib/php5/bin/php-cgi

Each website needs its own copy of the script. Place this script in the website’s dedicated cgi-bin directory. This should be a directory that you control to make sure that malicious scripts cannot be uploaded to take advantage of suexec. Make sure that the script is owned by the user and group who owns the website, otherwise suexec will refuse to run the script, and you’ll spend quite a bit of time scratching your head wondering what the problem is!

The FastCGI wrapper script gives us an opportunity to set limits on how PHP works as a FastCGI process. We can tell it how many FastCGI scripts are allowed to run (to make sure one website doesn’t use up all of the web server’s free capacity), and also how many HTTP requests each FastCGI process should handle before terminating (to limit the impact of memory leaks).

At this point, you can restart Apache, and you should find that your websites are now using suexec + FastCGI to run as separate users.

Making Apache Go Even Faster

One of the major benefits of using Apache 2.2 over Apache 1.3 is the ability to switch how Apache works at the fundamental level. Apache MPMs (multi-processing modules) can emulate Apache 1.3’s behaviour (mpm-prefork) … but it can also provide new options. By default, most (if not all) Linux distributions install Apache 2.2 built with mpm-prefork, but by switching to another MPM, can we make our websites go even faster?

If you are using suexec + mod_fcgid on Linux, there are two MPMs available to you that have the potential to boost performance further: mpm-worker and mpm-event. Both MPMs turn Apache into a multi-threaded server. On Linux systems, it is usually much quicker to create new threads than it is to create new processes. The downside is that software has to be specially written to work correctly in a multi-threaded application (known as being thread-safe). mod_php doesn’t work reliably with mpm-worker and mpm-event, because it reuses a lot of third-party code that may or may not be thread-safe. But because we’re running PHP in a separate FastCGI process, we can safely turn Apache into a multi-threaded server.

Some Benchmarks

To benchmark PHP + FastCGI + suexec, I used Apache s ab benchmark to load a simple phpinfo() page 1,000 times. I ran the benchmark five times, and averaged the results. To compare the results, I repeated the tests against mpm-worker, mpm-event, and mpm-prefork both with and without mod_php.

  • mpm-worker + mod_fcgid + PHP/FastCGI + suexec: 7.36 seconds, 0.2% failure rate
  • mpm-event + mod_fcgid + PHP/FastCGI + suexec: 7.75 seconds, 0.2 % failure rate
  • mpm-prefork + mod_fcgid + PHP/FastCGI + suexec: 7.92 seconds, 0.2% failure rate
  • mpm-prefork + mod_fastcgi + PHP/FastCGI + suexec: 8.52 seconds, 0.2% failure rate
  • mpm-prefork + mod_php: 7.38 seconds, 0% failure rate

Other Considerations

The performance is good, especially if you switch Apache MPMs. These benchmarks are extremely simplistic, and what they don’t show is that switching to mpm-worker and mpm-event will probably speed up your websites even further, because these Apache MPMs handle downloading images more efficiently than mpm-prefork can. You may also be able to scale your websites better before having to upgrade your servers or add additional ones, especially if you use a bytecode cache such as APC or xcache.

But what are the downsides?

  • As with straight suexec, you can’t use HTTP authentication in your application. Hardly any apps rely on this functionality any more (probably because so many shared hosting servers use suexec).
  • Your server may require extra RAM to cope with the number of FastCGI processes running simultaneously. You may need to switch to a 32-bit Linux kernel that supports PAE or to a 64-bit Linux distro.
  • Apache + PHP/FastCGI is not 100% reliable in my testing.


It is possible to combine PHP, FastCGI and suexec to produce a solution that secures a shared hosting server and at the same time provides good performance compared to the alternatives. If you’re prepared to compile Apache from source and switch MPMs, you can squeeze even more performance from this combination, and perhaps even out-perform the venerable mod_php.

Unfortunately, my experience was that the PHP + FastCGI combination cannot be trusted to serve pages 100% of the time. The average failure rate was 2 requests per 1000, and the failure rate was consistent no matter which Apache MPM was used, which Apache FastCGI module was used, and how many thousands of requests I used in my testing. At the time of writing, I haven’t tracked down the cause of this failure, and it may not appear in your own environment, but none of the previous solutions I’ve looked at in this series have displayed this problem, so it’s something to think about before chosing PHP + FastCGI to serve your websites. I’m hoping to find time in the future to get to the bottom of this problem, if no-one gets there first.

As a result, I can’t recommend using PHP/FastCGI + suexec at this time. My current recommendation is mpm-itk, which has successfully served millions of page hits for me in production over the last few months.


This article was made possible by information already on the internet:

This article is part of The Web Platform, an on-going series of blog posts about the environment that you need to create and nurture to run your web-based application in. If you have any topics that you d like to see covered in future articles, please leave them in the comments on this page.


… as recommended by readers of Planet PHP :)

Most Recommendations

There were six Firefox extensions that folks repeatedly recommended …

  1. ColorZilla – advanced eyedropper, color picker, page zoomer and other colorful goodies.
  2. FireBug – live DOM & CSS inspector. The single greatest web developer add-on for Firefox.
  3. Live HTTP Headers – view HTTP headers of a page and whilst browsing.
  4. Web Developer Toolbar – adds a menu and a toolbar with various web developer tools.
  5. YSlow – Yahoo’s tool for analysing web pages and telling you why they are slow. Requires Firebug.
  6. Zend Studio Toolbar – debugging assistance for Zend Studio 5.5 and earlier. Isn’t mentioned on the Zend Studio 6 pages, so does that mean it is now obsolete?

… and after that, there was a lot of variety amongst the other extensions that were recommended.

Also Recommended

  1. Cache Status – easy cache status & management from the status bar.
  2. ChatZilla – IRC client for Firefox.
  3. Duplicate Tab – clone a tab along with its history.
  4. Edit Cookies – edit your cookies right in Firefox.
  5. Fasterfox – performance and network tweaks for Firefox.
  6. Firefox Accessibility Extension – test your web pages for functional accessibility features based on the iCITA HTML Best Practices.
  7. FirePHP – print to your Firebug console using a simple PHP function call.
  8. FireShot – take screenshots of web pages, and a whole lot more.
  9. Google Toolbar – Google’s famous in-browser search toolbar.
  10. GreaseMonkey – customise the way a web page displays using your own Javascript add-ons. See also Lifehacker’s Top 10 Greasemonkey User Scripts, and their Better GMail and Better Flickr add-ons to get an idea of just what can be done with Greasemonkey as a Firefox extension tool.
  11. HTML Validator – add HTML validation to your browser.
  12. IE Tab (Windows only) – open Firefox tabs using IE’s rendering engine. See also the popular IE View alternative.
  13. LocationBar2 – adds additional features to Firefox’s address bar.
  14. Lorem Ipsum content generator – Generate “Lorem Ipsum” dummy text, for when you need to fill a page with content for testing purposes.
  15. MeasureIt – draw out a ruler to get the pixel width and height of any element on the web page.
  16. NagiosChecker – see the status of your services and servers in Firefox’s status bar. You do monitor your servers, right? 😉
  17. PrefBar – power user toolbar for Firefox.
  18. Regular Expressions Tester – testing tool for regular expressions with colour highlighting.
  19. RefSpoof – easy spoofing of the HTTP referrer header.
  20. ReloadEvery – reloads a web page every so many seconds.
  21. Save Session – save your current browser windows & tabs for the next time you open Firefox.
  22. Scrapbook – save web pages locally and easily manage collections. (Like OS X web archives, as supported by Together, DevonThink, and so on, but cross-platform).
  23. Selenium IDE – record, edit and debug tests for Selenium, the automated UI testing tool for web developers. See also PHPUnit’s support for Selenium. You do have reproducible testing for you web apps, right? 😉
  24. Stylish – fix ugly sites, customise the look of your browser or mail client by using your own CSS files. Stylish is to CSS what Greasemonkey is to Javascript.
  25. Tab Mix Plus – tab management on steroids.
  26. Tamper Data – view and modify HTTP/HTTPS headers and POST parameters.
  27. TimestampDecode – treats the selected number as a timestamp and displays a decoded date/time.
  28. TitlebarTweaks – tweak Firefox’s titlebar text.
  29. User Agent Switcher – Adds a menu and a toolbar button to switch the user agent of the browser.
  30. Venkman – Javascript debugger for Firefox.

Stu’s Recommends

To round off the list, here are a few extensions that I find useful, but which weren’t recommended. If you haven’t heard of these before, give them a try.

  1. Flagfox – display a country flag in the status bar for the location of the current website’s server.
  2. Server Switcher – easily switch between development and production servers.
  3. Show MyIP – display your current external IP address.
  4. SQLite Manager – Manage any SQLIte database on your computer.

Are you a web developer? Got a favourite Firefox extension that isn’t on this list? Let us know in the comments below.

Be the first to leave a comment »

The folks from Packt Publishing recently sent me another of their books to review. If you’re not familiar with Packt, they’re a relatively new book publisher who are steadily building up quite a range of technology books on open source software, normally written by people involved or close to the software being written about. They’re like a modern day equivalent to the old O’Reilly of the 90’s, only (imho) with higher quality :)

A Bit About Packt

Mastering phpMyAdmin 2.11 for Effective MySQL Management by Marc Delisle is the third edition of this book, and it follows the usual pattern of Packt Publishing books. The book has clearly defined objectives on the cover, and it follows a clear progression of its chosen subject from start to end. It is well presented, with a clear layout and clean page design that makes it easy to read. The book also includes a sizeable index, something no decent technical book can be without.

I’m really pleased to see that Packt are now providing example code online for download, as well as online errata for the book. Many of their earlier books reviewed here on Planet PHP have been criticised for not doing so; it’s great to see Packt improving in this area.

No matter which Packt book you pick up, don’t let the use of language be the reason you put it back on the shelf. Most Packt books are written and reviewed by folks who don’t speak English as their first language. Once you get used to it, it’s never really a problem, but it’s worth pointing it out because if you browse their books at your local bookstore, it might put you off at first.

Introducing phpMyAdmin

If you’ve never heard of it, phpMyAdmin is (imho) one of the most important open source projects for the LAMP stack. phpMyAdmin provides a web-based admin interface for MySQL, making it extremely easy for folks new to the LAMP stack to start working with databases, and a very convenient way to avoid firing up the MySQL command-line if you need to check something or make changes to your databases.

It feels like phpMyAdmin has been around forever.

Unfortunately, it looks that way too at times. In the post Google Maps world of AJAX enabled slick and efficient user interfaces, phpMyAdmin’s usefulness can be hampered by its Web 1.0 UI, and by its continued reliance of manual configuration instead of a WordPress-like admin panel. Don’t get me wrong, phpMyAdmin is a good tool without equal atm, but it’s a workmanlike and functional tool that younger folks used to the Facebook world find a bit long in the tooth.

About The Book

Marc’s book is aimed both at folks new to MySQL and phpMyAdmin as well as experienced developers such as myself who aren’t aware of the advanced features that have been added over the years. The full chapter list is:

  1. Introducing phpMyAdmin
  2. Installing phpMyAdmin
  3. Interface Overview
  4. First Steps
  5. Changing Data
  6. Changing Table Structures
  7. Exporting Structure and Data
  8. Importing Structure and Data
  9. Searching Data
  10. Table and Database Operations
  11. The Relational System
  12. Entering SQL Commands
  13. The Multi-Table Query Generator
  15. System Documentation
  16. MIME-Based Transformations
  17. Character Sets and Collations
  18. MySQL 5.0 Features
  19. MySQL Server Administration
  20. Troubleshooting and Support

The first ten chapters cover the basics of using phpMyAdmin. If you’re new to phpMyAdmin, these chapters will be very helpful to you, and if you’ve been using phpMyAdmin for years, there’s still little bits in here that you might not have been aware of before now. I particularly like the way that these chapters often refer back to the configuration settings in phpMyAdmin’s config file. However, towards the end of this section, the material starts to feel a bit rushed, as if the author himself can’t wait to get onto the clever features of phpMyAdmin that have yet to come. If you’re completely new to MySQL, you might find the end of this section to be a little light on detail. I hope the next edition of this book beefs these chapters up a bit.

Like most people I know, my use of phpMyAdmin over the years has tended to stick with the basics: creating and browsing tables. I confess, it’s partly because I’ve found the phpMyAdmin UI to be more and more clunky as time has gone by, a throwback to the days before Google showed us just what could be done with Javascript and AJAX. So the second half of the book, which looks at the more advanced features of phpMyAdmin, were ones I found very educational. I had no idea, for example, that phpMyAdmin now includes an AJAX-based Designer tool, or that I can use phpMyAdmin to generate PDF documentation of my databases. I found these chapters to be very detailed and informative, although again towards the end of the second half of the book, the chapters began to feel a little rushed in places to me.


I have several new starters joining my team in June, and it’ll be interesting to see whether or not they find the book useful as they find their feet in their first job doing PHP web development. One thing’s for sure: I’ll have no hesitation in leaving this book out for them to read.


I’m still working on the next article in my series looking at PHP on servers, so in the mean time, check out this simple way to emulate Ruby’s nice way of handling separate getter, setter and state query methods in PHP:

[code lang="php"]
class Example
	private $canCache = false;
	private $cacheXml = null;

	function canCache($newState = null)
		// check if we are querying or changing state
                if ($newState === null)
 			// we are querying
 			return $this->canCache;

  	 	// if we get here, we are a traditional getter/setter method
 		if ($newState)
 			$this->canCache = true;
 			$this->cacheXml = $this->_toXml();
 			return true;
 			$this->canCache = false;
 			return false;

$exObj = new Example();
if ($exObj->canCache())
 	// ... do something here

It isn’t as elegant as Ruby, but it does the job, and it means that your classes don’t have to be full of seperate canDoSomething() and isSomethingAllowed() type methods. I think it makes the code that uses the object a little easier to read, and a little more intuitive. YMMV.


I’ve recently switched my blog from b2evolution back to WordPress. The good news is both “no more spam :)” and “the admin panel works in Safari”, but on the downside I missed the multiblog feature that attracted me to b2evolution in the first place. There is WordPress MU, I suppose, but after coming across a few plugins that warned they didn’t work with WordPress MU, that option didn’t look very appealing.

Ah ha – thinks I – I can fake the multiblog by putting several different blogs on the site, and generating a homepage from the RSS feeds of the individual blogs. Should be simple enough, and it sounds like the perfect nail to hit with the SimpleXML hammer of PHP 5 :) Funnily enough, in work last week we were wondering whether you could use SimpleXML with XML namespaces (alas, we still use PHP 4 at work atm), so armed with the perfect excuse, I set to work.

Getting an RSS 2 feed into SimpleXML is trivial:

[code lang=”php”]
$feedUrl = ‘’;
$rawFeed = file_get_contents($feedUrl);
$xml = new SimpleXmlElement($rawFeed);

Extracting the information from the RSS ‘channel’ is equally trivial:

[code lang=”php”]
$channel[‘title’] = $xml->channel->title;
$channel[‘link’] = $xml->channel->link;

… and so on. Getting at the individual articles starts off just as easy:

[code lang=”php”]
foreach ($xml->channel->item as $item)
$article = array();
$article[‘title’] = $item->title;
$article[‘link’] = $item->link;

… but, if you’re relying on the very thin SimpleXML documentation on, like me you’ll soon run into two problems.

Some of the elements in an item sit inside different XML namespaces. The only way to get at them is to use the children() method on a SimpleXMLElement:

[code lang=”php”]
$dc = $item->children(‘’);
$article[‘creator’] = $dc->creator;
foreach ($dc->subject as $subject)
$article[‘subject’][] = $dc->subject;

That’s a bit of a mouthful. It’s a bit of a shame that I can’t do this:

[code lang=”php”]
// The following does NOT work!
$article[‘creator’] = $article->dc->creator;

… or some variation on that, but the design of XML namespaces makes that impractical. (The XML namespace is actually the URI; the ‘dc’ prefix in a tag like <dc:creator> is shorthand defined in the opening tag at the top of the XML document. Although it would look a bit odd, there’s nothing at all to stop someone defining the ‘dc’ component as ‘dublinCore’ instead if they wanted to).

Having to pass the full URI for a namespace into children() is not my idea of fun! It’d be much better if we could pass in a shorter string instead. The only way to safely do this is to define an array of shortcuts yourself:

[code lang=”php”]
// define the namespaces that we are interested in
$ns = array
‘content’ => ‘’,
‘wfw’ => ‘’,
‘dc’ => ‘’

// now we can get dublin core content with a lot less typing!
// we also only have to update the code in one place if the namespace URI changes
$dc = $item->children($ns[‘dc’]);
$article[‘creator’] = $dc->creator;

You can get a list of the namespaces like this:

[code lang=”php”]
$ns = $xml->getNamespaces(true);
$dc = $item->children($ns[‘dc’]);

… but that only works if the XML document defines the prefix ‘dc’ for the namespace ‘’. You’ll have to decide for yourself whether it’s a risk worth taking or not.

That’s namespaces tamed, but we’re not quite home yet. The actual ‘content’ part of the article sits inside a CDATA section inside a ‘content’ namespace, and how to deal with CDATA is conspicuous by its absence in the SimpleXML docs (probably because older versions of SimpleXML simply threw CDATA sections away without asking you).

If you have a look at the source code for SimpleXML, test 004 shows how basic CDATA access works.

[code lang=”php”]
$content = $item->children($ns[‘content’]);
$article[‘content’] = (string) trim($content->encoded);

With that, the final code to read a RSS 2 feed looks like this:

[code lang=”php”]
// define the namespaces that we are interested in
$ns = array
‘content’ => ‘’,
‘wfw’ => ‘’,
‘dc’ => ‘’

// obtain the articles in the feeds, and construct an array of articles

$articles = array();

// step 1: get the feed
$blog_url = ‘’;

$rawFeed = file_get_contents($blog_url);
$xml = new SimpleXmlElement($rawFeed);

// step 2: extract the channel metadata

$channel = array();
$channel[‘title’] = $xml->channel->title;
$channel[‘link’] = $xml->channel->link;
$channel[‘description’] = $xml->channel->description;
$channel[‘pubDate’] = $xml->pubDate;
$channel[‘timestamp’] = strtotime($xml->pubDate);
$channel[‘generator’] = $xml->generator;
$channel[‘language’] = $xml->language;

// step 3: extract the articles

foreach ($xml->channel->item as $item)
$article = array();
$article[‘channel’] = $blog;
$article[‘title’] = $item->title;
$article[‘link’] = $item->link;
$article[‘comments’] = $item->comments;
$article[‘pubDate’] = $item->pubDate;
$article[‘timestamp’] = strtotime($item->pubDate);
$article[‘description’] = (string) trim($item->description);
$article[‘isPermaLink’] = $item->guid[‘isPermaLink’];

// get data held in namespaces
$content = $item->children($ns[‘content’]);
$dc = $item->children($ns[‘dc’]);
$wfw = $item->children($ns[‘wfw’]);

$article[‘creator’] = (string) $dc->creator;
foreach ($dc->subject as $subject)
$article[‘subject’][] = (string)$subject;

$article[‘content’] = (string)trim($content->encoded);
$article[‘commentRss’] = $wfw->commentRss;

// add this article to the list
$articles[$article[‘timestamp’]] = $article;

// at this point, $channel contains all the metadata about the RSS feed,
// and $articles contains an array of articles for us to repurpose

Don’t forget to add error handling :)

I hope this example helps anyone else who needs to work with RSS 2 feeds, or who needs to know how to work with namespaces and CDATA with SimpleXML.

Page 3 of 3123

This Month

November 2015
« Oct