cgi and php

[Jeremy Shovan]

What do I need to do to make php run from the cgi-bin

Everything I try gives me an error 500 "premature End of Script Headers"

It is running (trying to run) on a virtual server. The file owner is the
same uid as the site admin and it is chmoded to 775

The name of the file is test.php for the contents I have tried:
---test.php----
#! /usr/bin/php
<?php
echo "test";
?>
----end--------
and:
----test.php-------
<?php
echo "test.php";
?>
----end--------

[Jeremy Shovan]

Re: cgi and php

Jeremy Shovan wrote:
[color=blue]
> What do I need to do to make php run from the cgi-bin
>
> Everything I try gives me an error 500 "premature End of Script Headers"
>
> It is running (trying to run) on a virtual server. The file owner is the
> same uid as the site admin and it is chmoded to 775
>
> The name of the file is test.php for the contents I have tried:
> ---test.php----
> #! /usr/bin/php
> <?php
> echo "test";
> ?>
> ----end--------
> and:
> ----test.php-------
> <?php
> echo "test.php";
> ?>
> ----end--------[/color]

Also:
when I run php -v the output is:
PHP 4.3.4 (cgi) (built: Nov 10 2003 10:36:06)
Copyright (c) 1997-2003 The PHP Group
Zend Engine v1.3.0, Copyright (c) 1998-2003 Zend Technologies
with Zend Extension Manager v1.0.1, Copyright (c) 2003, by Zend
Technologies
with Zend Optimizer v2.5.1, Copyright (c) 1998-2004, by Zend
Technologies
with Zend Debugger v3.0.1, Copyright (c) 1999-2003, by Zend
Technologies

[Jeffrey Silverman]

Re: cgi and php

On Mon, 12 Jul 2004 13:11:56 -0700, Jeremy Shovan wrote:
[color=blue]
> What do I need to do to make php run from the cgi-bin
>
> Everything I try gives me an error 500 "premature End of Script Headers"
>
> It is running (trying to run) on a virtual server. The file owner is the
> same uid as the site admin and it is chmoded to 775
>
> The name of the file is test.php for the contents I have tried:
> ---test.php----
> #! /usr/bin/php
> <?php
> echo "test";
> ?>
> ----end--------
> and:
> ----test.php-------
> <?php
> echo "test.php";
> ?>
> ----end--------[/color]

I am just taking a couple of guesses that may be wrong:

1) try removing the space in the pound-bang line, like so:

#!/usr/bin/php

2) Try outputting the proper content type before any other output. I know
you have to do this for Perl CGI scripts, for example:

echo "Content-type: text/html\n\n";


Just guesses.

--
Jeffrey D. Silverman | jeffrey@pantsjh u.edu **
Website | http://www.newtnotes.com

(** Drop "pants" to reply by email)

[Michael Austin]

Re: cgi and php

Jeffrey Silverman wrote:
[color=blue]
> On Mon, 12 Jul 2004 13:11:56 -0700, Jeremy Shovan wrote:
>
>[color=green]
>>What do I need to do to make php run from the cgi-bin
>>
>>Everything I try gives me an error 500 "premature End of Script Headers"
>>
>>It is running (trying to run) on a virtual server. The file owner is the
>>same uid as the site admin and it is chmoded to 775
>>
>>The name of the file is test.php for the contents I have tried:
>>---test.php----
>>#! /usr/bin/php
>><?php
>> echo "test";
>>?>
>>----end--------
>>and:
>>----test.php-------
>><?php
>> echo "test.php";
>>?>
>>----end--------[/color]
>
>
> I am just taking a couple of guesses that may be wrong:
>
> 1) try removing the space in the pound-bang line, like so:
>
> #!/usr/bin/php
>
> 2) Try outputting the proper content type before any other output. I know
> you have to do this for Perl CGI scripts, for example:
>
> echo "Content-type: text/html\n\n";[/color]
^^^^ note there are 2 newlines here.

Personnally trying to use php as cgi as opposed to calling it directly is more
resource intensive than it should be...
[color=blue]
>
>
> Just guesses.
>[/color]


--
Michael Austin.
Consultant - Available.
Donations welcomed. Http://www.firstdbasource.com/donations.html
:)

[Jeremy Shovan]

Re: cgi and php

Jeffrey Silverman wrote:
[color=blue]
> On Mon, 12 Jul 2004 13:11:56 -0700, Jeremy Shovan wrote:
>
>[color=green]
>>What do I need to do to make php run from the cgi-bin
>>
>>Everything I try gives me an error 500 "premature End of Script Headers"
>>
>>It is running (trying to run) on a virtual server. The file owner is the
>>same uid as the site admin and it is chmoded to 775
>>
>>The name of the file is test.php for the contents I have tried:
>>---test.php----
>>#! /usr/bin/php
>><?php
>> echo "test";
>>?>
>>----end--------
>>and:
>>----test.php-------
>><?php
>> echo "test.php";
>>?>
>>----end--------[/color]
>
>
> I am just taking a couple of guesses that may be wrong:
>
> 1) try removing the space in the pound-bang line, like so:
>
> #!/usr/bin/php
>
> 2) Try outputting the proper content type before any other output. I know
> you have to do this for Perl CGI scripts, for example:
>
> echo "Content-type: text/html\n\n";
>
>
> Just guesses.
>[/color]
I finally got it to do something other than give me an error 500 but now
it gives me the error

Security Alert! The PHP CGI cannot be accessed directly.

This PHP CGI binary was compiled with force-cgi-redirect enabled. This
means that a page will only be served up if the REDIRECT_STATUS CGI
variable is set, e.g. via an Apache Action directive.

Any Suggestions??

[Michael Austin]

Re: cgi and php

Jeremy Shovan wrote:
[color=blue]
> Jeffrey Silverman wrote:
>[color=green]
>> On Mon, 12 Jul 2004 13:11:56 -0700, Jeremy Shovan wrote:
>>
>>[color=darkred]
>>> What do I need to do to make php run from the cgi-bin
>>>
>>> Everything I try gives me an error 500 "premature End of Script Headers"
>>>
>>> It is running (trying to run) on a virtual server. The file owner is the
>>> same uid as the site admin and it is chmoded to 775
>>>
>>> The name of the file is test.php for the contents I have tried:
>>> ---test.php----
>>> #! /usr/bin/php
>>> <?php
>>> echo "test";
>>> ?>
>>> ----end--------
>>> and:
>>> ----test.php-------
>>> <?php
>>> echo "test.php";
>>> ?>
>>> ----end--------[/color]
>>
>>
>>
>> I am just taking a couple of guesses that may be wrong:
>>
>> 1) try removing the space in the pound-bang line, like so:
>>
>> #!/usr/bin/php
>>
>> 2) Try outputting the proper content type before any other output. I
>> know
>> you have to do this for Perl CGI scripts, for example:
>>
>> echo "Content-type: text/html\n\n";
>>
>>
>> Just guesses.
>>[/color]
> I finally got it to do something other than give me an error 500 but now
> it gives me the error
>
> Security Alert! The PHP CGI cannot be accessed directly.
>
> This PHP CGI binary was compiled with force-cgi-redirect enabled. This
> means that a page will only be served up if the REDIRECT_STATUS CGI
> variable is set, e.g. via an Apache Action directive.
>
> Any Suggestions??[/color]

yes... don't use PHP in CGI mode unless you want to get hacked...

--
Michael Austin.
Consultant - Available.
Donations welcomed. Http://www.firstdbasource.com/donations.html
:)

[Lc]

Re: cgi and php


What's the interest to do so??


"Jeremy Shovan" <jeremys013@fou ndationx.com> a écrit dans le message de
news:wfCIc.8921 $i_3.2911@fed1r ead04...[color=blue]
> What do I need to do to make php run from the cgi-bin
>
> Everything I try gives me an error 500 "premature End of Script Headers"
>
> It is running (trying to run) on a virtual server. The file owner is the
> same uid as the site admin and it is chmoded to 775
>
> The name of the file is test.php for the contents I have tried:
> ---test.php----
> #! /usr/bin/php
> <?php
> echo "test";
> ?>
> ----end--------
> and:
> ----test.php-------
> <?php
> echo "test.php";
> ?>
> ----end--------[/color]

[2metre]

Re: cgi and php

> yes... don't use PHP in CGI mode unless you want to get hacked...

In what way is PHP in CGI mode more hackable?

[2metre]

Re: cgi and php

Michael Austin wrote:[color=blue]
> yes... don't use PHP in CGI mode unless you want to get hacked...[/color]

Michael Austin: I would still appreciate an answer to my question....
"In what way is PHP in CGI mode more hackable?"

I use a lot of PHP in CGI mode. If there are any additional security
problems about which I'm unaware I'd certainly like to know.

(The reason I use PHP in CGI mode is so that I can substitute PHP
scripts with compiled apps written in C[/++] or Pascal without having to
change any links.)

[For example John Smith]

Re: cgi and php

2metre wrote:[color=blue]
> Michael Austin wrote:[color=green]
>> yes... don't use PHP in CGI mode unless you want to get hacked...[/color]
>
> Michael Austin: I would still appreciate an answer to my question....
> "In what way is PHP in CGI mode more hackable?"
>
> I use a lot of PHP in CGI mode. If there are any additional security
> problems about which I'm unaware I'd certainly like to know.
>
> (The reason I use PHP in CGI mode is so that I can substitute PHP
> scripts with compiled apps written in C[/++] or Pascal without having
> to change any links.)[/color]

Read here: http://www.phpbuilder.com/manual/security.php
How can you use pascal scripts without having to change a link ???

[2metre]

Re: cgi and php

For example John Smith wrote:
[color=blue]
> 2metre wrote:
>[color=green]
>>Michael Austin wrote:
>>[color=darkred]
>>>yes... don't use PHP in CGI mode unless you want to get hacked...[/color]
>>
>>Michael Austin: I would still appreciate an answer to my question....
>>"In what way is PHP in CGI mode more hackable?"
>>
>>I use a lot of PHP in CGI mode. If there are any additional security
>>problems about which I'm unaware I'd certainly like to know.
>>
>>(The reason I use PHP in CGI mode is so that I can substitute PHP
>>scripts with compiled apps written in C[/++] or Pascal without having
>>to change any links.)[/color]
>
>
> Read here: http://www.phpbuilder.com/manual/security.php[/color]

Thanks for the reply. The link tells me that PHP as CGI is very secure
if you follow simple guidelines. Michael Ausitin seems to suggest it is
very hackable. I'd like to know if he has any fresh info on this.
[color=blue]
> How can you use pascal scripts without having to change a link ???[/color]
If the scripts all have names like dosomething.cgi then I can either
write the script in PHP with the first line containing the 'shebang line'
eg #!/usr/local/bin/php
OR I can use a compiled pascal program.

Either way they can be called dosomething.cgi .
If I substititute a PHP script with a pascal app (or vice-versa), the
links are identical.