04 January 2008, 10:38

Support for PHP 4 discontinued

The newly released version 4.4.8 of the PHP scripting language closes a number of security holes and is intended to ensure greater stability. However, this is the last "normal" release of PHP 4 and support has ceased with effect from 31 December 2007. Nevertheless, if necessary, security releases will continue being issued until 8 August 2008.

Among other things, version 4.4.8 eliminates integer overflows in the functions chunk_split(), strcspn() and strspn(). Also, in the new version it is no longer possible to exploit a particular error in the function glob() by means of the function open_basedir in order to circumvent possible restrictions. Nor is this now possible with certain SQL queries. A fix has also been added for an error described in the Month of PHP Bugs (MOPB). Another MOPB error has only now been removed, so that the nesting of input variables can be limited with the new PHP option "max_input_nesting_level".

The developers recommend users of PHP 4 to update to version 4.4.8 as soon as possible but they nevertheless recommend that a change to PHP 5.2 be considered. However a user is not always in a position to do this, for example when using a shared hosting service that only offers PHP4.