Running PHP as CGI, any drawback?

I'm recommended by my host to use PHP as CGI (I can switch back if I want to) for security purpose. I wonder if it will have any effect on Zencart and Wordpress ? Will something stops working because of that?

Regards,
yellow1912

works well for us,

PHP running as CGI is definitely more secure, than PHP as an Apache module.

There could be some trip-ups though, since you can no longer use 777 permissions anywhere and "nobody" cannot own any files. If not sure about these then best to discuss with your Hoster; somebody has to make sure all permissions are correct.

On the plus side, wherever 777 permissions on directorys were previously required to work properly, will now work just fine with 755 permissions -- without having to worry (as much) about somebody uploading something they shouldn't.

Also, any PHP directives previously setup in an .htaccess file, will have to be removed and placed in a "php.ini" file -- with syntax changes as well.

Also, any PHP directives previously setup in an .htaccess file, will have to be removed and placed in a "php.ini" file -- with syntax changes as well.

Zencart has many .htaccess files, do I need to make any change?

The htaccess in my root folder is like this

Options +FollowSymlinks
RewriteEngine on
RewriteBase /
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L]
```It's for automatically redirecting users to <https://www.domain.com> if they visit domain.com, will it continue to work with the new setting?

Thanks,

yellow1912

All .htaccess files provided within a Default Zen Cart setup have directives that apply only to Apache. These will not cause any problems, regardless of how PHP is run. The directives in your last post for example, are strictly for Apache and will not cause problems.

For security reasons the following should always be used, regardless of where your site is Hosted and how PHP is run.

If PHP is run as an Apache module:

in - public_html/.htaccess
php_flag session.use_trans_sid off
php_value register_globals off

If PHP is run as CGI

in - public_html/php.ini
session.use_trans_sid = off
register_globals = off

How to tell how PHP is being used?

If, after the transfer, the directives shown above for an .htaccess file are still in your .htaccess file and new site is running without problems, then safe to say PHP is run as an Apache module.

If, after the transfer, the directives shown above for an .htaccess file are still in your .htaccess file and new site is kicking out errors, then safe to say PHP is run as CGI. You would remove any PHP directives and put them in a "php.ini" file, changing syntax as necessary.

to tell that your running php as cgi,
look in your phpinfo file

it will tell you is the php handler is apache cli or cgi/fastcgi

also if your in control of your own destiny then when you compile apache/php choose cgi safe mode,
this will not allow local php.ini files to override the globals,

also yes all folders can now be set to 755 files should be set to 644 or less
( exception is the config files need to be 444 otherwise the security error in ZC will show,
this is because to the system 644 is still writable )

Thanks guys. I'm moving to the new server as of now. Will report back if anything happens.

Is there a noticeable speed or other difference when using the fastCGI? Does the zencart dev team recommend using it?

Thanks!

Matt