4

Situation:: My current web host has given me a brand new VPS today with PHP 5.2.9 (released: Feb 2009).

What I did: I asked my web host to upgrade it to latest PHP 5.3.5 so I can get all security vulnerabilities fixed.

What web host replied: No, you should not. Your PHP scripts will break. Instead you can use PHP 5.2.17.

My Question: Should I force my web host to install PHP 5.3.5 on my VPS? What problem can possibly I get by upgrading. I currently do not use any PHP 5.3 features but may use those in future. My main concern is to get fully secure from known vulnerabilities.

Please don't close this question. It's not directly related to programming but is related to PHP which only PHP experts at SO can answer, I guess.

WhatIsOpenID
  • 1,071
  • 4
  • 12
  • 20

3 Answers3

3

Well, simply install PHP 5.3.5 locally and see if any of your scripts break. If everything's okay, let them install PHP 5.3.

Concerning "It will break things": PHP normally is backwards compatible. Maybe it will give you some E_STRICT errors, but those don't break scripts. But really, you should just try ;)

NikiC
  • 100,734
  • 37
  • 191
  • 225
  • I am going to install mostly Wordpress (which should not cause problems) and then some of my own written scripts. `E_STRICT` can be disabled, right ? – WhatIsOpenID Jan 22 '11 at 15:19
  • @WhatIsOpenID: Sure. All errors can be hidden. Though I assume that the latest Wordpress versions are 5.3 compatible anyway ;) – NikiC Jan 22 '11 at 15:40
1

An old release date does not means that it has vulnerabilities. For instance most Linux distributions keep the same PHP version forever (for the lifetime of the distribution's release), but they fix vulnerabilities as they are discovered.

Just make sure that all your distribution's packages are up to date.

Arnaud Le Blanc
  • 98,321
  • 23
  • 206
  • 194
  • 1
    Old versions do have problems. Check this: http://www.php.net/ChangeLog-5.php#5.2.9 – WhatIsOpenID Jan 22 '11 at 15:20
  • 1
    True, but descent distributions fix the most critical bugs, and all security ones. This is how they do security upgrades without breaking your code. (Not saying that 5.3 would break your code.) – Arnaud Le Blanc Jan 22 '11 at 15:23
  • OK, so is there any way to let me check whether those crititcal bugs are are fixed or not ? – WhatIsOpenID Jan 22 '11 at 15:26
1

If its a VPS do you have root access? If so you could upgrade yourself. I imagine it should be possible with a little work to install both versions.

Jonny Barnes
  • 515
  • 1
  • 12
  • 28
  • Yes, I have root access. But, I don't feel comfortable installing it myself. I have FULL managed hosting and they will do everything I ask for. – WhatIsOpenID Jan 22 '11 at 15:20