image directory outside of the document root available to the web server and serve it via intermediary script, or disable PHP execution for the directory which stores the uploaded files. Also, enabling the dynamic loading of PHP extensions (via enable_dl configuration directive) in a shared web hosting environment can lead to security issues. Implied type conversions that result in different values being treated as equal, sometimes against the programmer's intent, can lead to security issues. For example, the result of the comparison is true, because strings that are parsable as numbers are converted to numbers; in this case, the first compared value is treated as scientific notation having the value (), which is zero. Errors like this resulted in authentication vulnerabilities in Simple Machines Forum, Typo3 and phpBB when MD5 password hashes were compared. The recommended way is to use hash_equals() (for timing attack safety), strcmp or the identity operator (===), as results in false. In a 2013 analysis of over 170,000 website defacements, published by Zone-H, the most frequently (53%) used technique was exploitation of file-inclusion vulnerability, mostly related to insecure usage of the PHP language constructs include, require, and allow_url_fopen. W3Techs reports that 64% of websites using PHP, use versions 7.2 or older (which are no longer supported by The PHP Development Team) with 35% of all PHP websites using version 5.6 or older. Version 5 is still used by 24.5% of all the websites (September 2021). It is highly recommended to migrate to PHP version 7 or 8 and use random_int() instead of rand() or mt_rand(), as the latter functions are not cryptographically-secure. There are two attacks that can be performed over PHP entropy sources: "seed attack" and "state recovery attack". With current GPU technologies an attacker can perform up to 2 MD5 calculations per second with a $250 GPU, while with an additional $500 can reach up to 2 calculations. In combination with a "birthday attack" this can lead to serious security vulnerabilities. See also Comparison of programming languages List of Apache–MySQL–PHP packages List of PHP accelerators List of PHP editors PEAR (PHP Extension and Application Repository) PHP accelerator Template processor XAMPP (free and open-source cross-platform web server solution stack package) Zend Server References Further reading External links 1995 software Articles with example PHP code Class-based programming languages Cross-platform software Dynamic programming languages Dynamically typed programming languages Filename extensions Free compilers and interpreters High-level programming languages