3

What are the benefits of running PHP as a CGI binary compared to running PHP as an Apache module? Are there:

  1. Security benefits?
  2. Stability benefits?
  3. Performance benefits?

I've always installed and used PHP as an Apache module so I'm curious if there's any reason for me to use PHP as a CGI binary for future work...

Thanks!

Aaron
  • 722
  • 2
  • 10
  • 19
  • 1
    @Aaron - Whether you compiler PHP from source or not, you'll still end up with an Apache module. Your question should be "Should I use PHP installed as CGI binary or module?" –  Jun 19 '11 at 02:11
  • Thanks Francois. I've updated the question to reflect your corrections. I guess I misunderstood what I was trying to ask... – Aaron Jun 19 '11 at 02:15
  • 2
    Generally: CGI is slower than the mod_php interface. But FastCGI is another story. And the security advantage of using either comes into play if you also utilize mod_suphp/suexec. – mario Jun 19 '11 at 02:19
  • Is there a noticeable speed difference when running PHP under FastCGI vs. PHP as a module? – Aaron Jun 19 '11 at 02:24
  • Btw, this question is [::::] http://stackoverflow.com/questions/3953793/mod-php-vs-cgi-vs-fast-cgi –  Jun 19 '11 at 03:11
  • Now I am little more confused. The two answers below say that PHP as a module is faster than PHP under CGI. The answer I just read from the link gaRex posted above says that PHP is much faster under FastCGI vs. as a module since you can use threading instead of forking in Apache. Does it go like this: FastCGI > Module > CGI? – Aaron Jun 19 '11 at 03:24

2 Answers2

4

When PHP is used as a module, it's more-or-less compiled into Apache's code itself. It's loaded for every request which means that it's loaded even for images, scripts, stylesheets and any other files that aren't PHP. It makes serving those pages slower. On the other hand, it makes PHP faster since Apache doesn't have to spawn additional processes.

When PHP is used as a CGI binary, it's more secure but it's slower. Apache can spawn processes under different users which, for example, can increase the security of a shared hosting environment. It also increases stability because the PHP processes are separate from Apache's and in the event of a segfault or other hard crash, PHP processes won't affect Apache. Using PHP as a CGI means that you can't use .htaccess file configure PHP using php_flag or php_value.

The question is, what's more important to you. Speed or security.

If you search for the benefits of using PHP in either CGI or modules on Google, I'm sure you'll find plenty of great articles that may cover things I may have missed.

Francois Deschenes
  • 156
  • 2
0

Typically you have 3 options: - php as webserver`s module (apache or iis) -> mod_php - cgi (old style each time start-up binary) - fast-cgi (more optimized binary)

By fast-cgi we means that it's apache`s fast-cgi without any fpm proxies and etc.

In both CGI modes your HTTP auth scripts will be not working.

Fastcgi is better than just CGI -- @see gugl for it, but 500 errors may happen.

By stability & performance mod_php is better.

gaRex
  • 426
  • 4
  • 6