Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

As we know, Suhosin hardens PHP and adds another layer of security. But unfortunately there is no official release for PHP 5.4/5.5 (that I can find anyway).

So that puts me in a small dilemma. Do I go with the newer PHP 5.4/5.5 which I presume are more secure than the older 5.3, or do I go with the older PHP 5.3 but with the security hardening patch of Suhosin?

Currently on my local machine I am running my code with PHP 5.3.5, so there is nothing inherently in PHP 5.4/5.5 that I need for my scripts to work. Security is paramount in this project though!

What is recommended in this instance? Or does it not matter? Suhosin seems to have some nice patches.

Thanks

share|improve this question
add comment

1 Answer 1

The most secure PHP version is the one you keep updated. Which version (and associated libraries) are maintained by an upstream provider (your Linux distro, assuming you're running Linux.) Are you building the binaries yourself? If so, make sure that you allocate the time needed to keep up with all security patches, not just in PHP, but also in libraries required by your application.

share|improve this answer
    
+1 for well argued answer - but in the case of PP a further question is whether you want to switch ZOP+ insead of APC. –  symcbean Jan 1 at 23:13
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.