about php.ini in every folder

[securitywonks]

Hello All

I like to have ioncube enabled in my website,

do I copy php.ini file in every folder?

currently, when I am using a ioncube tester, I found that, whichever folder, i keep the tester file and check, it is showing correctly (that ioncube is installed) only when php.ini file is in that folder.

is there, any way to have php.ini in single place for whole website instead of placing it in every folder?

--------------
I like to have SAFE_MODE turned OFF. I had turned off the setting in php.ini file, and copied in few folders. it shows as turned off in phpinfo (in the location where php.ini is located).

can we turn off SAFE_MODE under site to site or on server level configuration ?

-------------
I like to have session.save_path WRITABLE, please help

I had enabled the setting in php.ini file and uploaded to few locations, it's not working, please help,

thank you

[lnxcode]

Hello,

If you're running your apache as CGI, and you have a custom php.ini file, the file you need to have updated php in, yes, you will need to place a php.ini file.

This is one of the downsides of PHP as CGI, but the upside is you don't have to worry about nobody files.

If you update your /usr/local/Zend/etc/php.ini file that is the global php.ini for the entire server unless you have a custom php.ini in your file (the custom will overwrite the main file).

[securitywonks]

so, writing the settings in the main server side php.ini file, things work by default and incase if some option is not useful in that way (in particular website, we can use custom php.ini for that website right) ?

---------
please share your thoughts on SAFE_MODE and session.save_path (whether making this setting writable in global php.ini good for us? or setting it as local setting will do good, if it is local setting, is it ok to keep in root directory of website or in all directories?)

thank you

[lnxcode]

Well, thats a personal choice if you want to disable safe_mode on your VPS. Its off by default, so not sure. It just depends on what you want to do. Since you're the sys admin.

I would leave it like it is setup, since if its working and you try to fix it, you could end up breaking it which would cause more problems for you.

You can set the file thats fine to /tmp that should work no problems (for the session.path).

Overall, if the user doesn't need it, better only enable it when someone needs it. Less risk then.

[securitywonks]

thanks for the info

cheers