PHP: Difference between revisions

Revision as of 07:14, 22 August 2025

Latest revision as of 05:17, 27 August 2025

(One intermediate revision by one other user not shown)

Line 285:

| {{n/a|Not released}}

| {{n/a}}

| Abandoned version of PHP that planned to include native Unicode support.<ref>{{cite web|last1=Corbet |first1=Jonathan |url=https://lwn.net/Articles/379909/|title=Resetting PHP&nbsp;6|date=24 March 2010 |quote=There have been books on the shelves purporting to cover PHP&nbsp;6 since at least 2008. But, in March 2010, the PHP&nbsp;6 release is not out{{snd}} in fact, it is not even close to out. Recent events suggest that PHP&nbsp;6 will not be released before 2011{{snd}} if, indeed, it is released at all.}}</ref><ref>{{cite news|url=http://www.infoworld.com/article/2841561/php/php-7-moves-full-speed-ahead.html|title=PHP&nbsp;7 moves full speed ahead|newspaper=InfoWorld |quote=Recent versions of PHP have been part of the 5.x release series, but there will be no PHP&nbsp;6. "We're going to skip [version]&nbsp;6, because years ago, we had plans for a&nbsp;6, but those plans were very different from what we're doing now," Gutmans said. Going right to version&nbsp;7 avoids confusion.|date=2014-10-31 |last1=Krill |first1=Paul }}</ref>

|-

| {{Version |o | 7.0}}

Line 1,081:

=== Cryptographic security ===

PHP includes <code>rand()</code><ref>{{cite web |title=PHP: Rand – Manual |url=https://php.net/rand}}</ref> and <code>mt_rand()</code> <ref>{{cite web |title=PHP: Mt_rand - Manual |url=https://php.net/mt_rand}}</ref></code> functions which use a [[pseudorandom number generator]], and are not cryptographically secure. As of version 8.1, the <code>random_int()</code> function is included, which uses a cryptographically secure source of randomness provided by the system.<ref>{{cite web | url=https://php.net/random_int | title=PHP: Random_int – Manual }}</ref>

There are two attacks that can be performed over PHP entropy sources: "seed attack" and "state recovery attack".{{Citation needed|date=November 2023}} As of 2012, a $250 [[Graphics processing unit|GPU]] can perform up to 2{{sup|30}} [[MD5]] calculations per second, while a $750 GPU can perform four times as many calculations at the same time.<ref>{{Cite web|url=https://www.usenix.org/conference/usenixsecurity12/technical-sessions/presentation/argyros|title=I Forgot Your Password: Randomness Attacks Against PHP Applications|website=usenix.org|publisher=[[USENIX]]|first1=George|last1=Argyros|first2=Aggelos|last2=Kiayias|date=10 August 2012|access-date=19 April 2024}}</ref> In combination with a "[[birthday attack]]" this can lead to serious security vulnerabilities.{{Citation needed|date=November 2023}}