情形四：PHP 解释器放在 web 目录以外

一个非常安全的做法就是把 PHP 解释器放在 web 目录外的地方，比如说 /usr/local/bin。这样做唯一不便的地方就是必须在每一个包含 PHP 代码的文件的第一行加入如下语句：

#!/usr/local/bin/php

还要将这些文件的属性改成可执行。也就是说，要像处理用 Perl 或 sh 或其它任何脚本语言写的 CGI 脚本一样，使用以 #! 开头的 shell-escape 机制来启动它们。

在这种情况下，要使 PHP 能正确处理 PATH_INFO 和 PATH_TRANSLATED 等变量的话，在编译 PHP 解释器时必须加入 --enable-discard-path 参数。

用户评论:

mails dot php dot net-notes at gunter dot ohrner dot net (2011-07-22 04:53:09)

You can invoke the interpreter under Apache 2.2 running in Windows by associating the php file extension with the interpreter binary in the registry: AddType application/x-httpd-php .php AddHandler cgi-script .php In the desired <Directory>-block, configure PHP CGI as follows: Options +ExecCGI ## Use HKEY_CLASSES_ROOT\.cgi\Shell\ExecCGI\Command ## to determine CGI script interpreter ## ("c:\program files\php-5.2.17\php-cgi.exe"). ## This key must be created manually. ScriptInterpreterSource Registry-Strict You need to disable cgi.force_redirect in this case, which should be safe from what I understand. You could probably simply use php.exe instead of php-cgi.exe, though I'd like to have this confirmed from someone else.

Andras Rokob <rokoba at bolyai dot elte dot hu> (2006-10-18 14:59:25)

You can avoid the need of using the shell-escaping (#! ...) in all your php scripts if you set the executable bit on them and exploit the binfmt_misc support of the Linux kernels.