PHP 8 is on the way. In this tutorial, I will show you how to install PHP 8 on your Windows 10 machine using Apache as a webserver.

Download the necessary files

This new major version brings with it a number of new features and some incompatibilities that should be tested for before switching PHP versions in production environments. See also the migration guides for PHP versions 7.0.x, 7.1.x, 7.2.x, 7.3.x. Php8，我来也; 从实战中学习php基础知识，让你知道每个php知识点，在实战怎么运用。 新方式讲解新版本，php8不一样的未来。 初级; 共35章节 14513次播放 添加时间：2021-04-01 13:44; 开始学习 课件下载 QQ交流群. SourceGuardian provides full PHP 4.x,5.x,7.x and PHP8+ support including the latest PHP8 language features along with many other protection and encryption options. Great GUI A new GUI for Windows, Linux and OS X. @Vmxes many thanks by your help, that is 100% efective: before: LoadModule php7module but for PHP8 using NOW: LoadModule phpmodule and that is all, run fine for me:-) – VyR Dec 3 '20 at 14:32 1 This worked with Laragon, which many of us prefer to XAMP. – s3c Jan 11 at 9:04.

You can download PHP binaries from the URL: https://windows.php.net/download/.
Currently, the final version of PHP 8 has not been released, therefore, it cannot be found on the main page. Select the 'QA Releases' from the top menu or navigate directly to https://windows.php.net/qa/.

Download the thread-safe, 32, or 64-bit version depending on your Windows type. As all versions have been compiled with VisualStudio 16 (2019), so later, you need a suitable Apache binary and a 'Microsoft Visual C++ 2019 Redistributable' package installed on your PC.

I like the programs to be in the Program Files folder. Besides this, over time, you will install several different versions of PHP. Therefore, I create the following directory structure:

For the sake of ease of use, I make some sacrifices in the security of my development machine. I give local users full permission to the PHP directory on my machine.

Once you have created the directory, copy the contents of the downloaded zip file.

Php8 Gui

Check if PHP works

As I mentioned earlier, PHP 8 was compiled with Visual Studio 2019. Thus, if the appropriate Redistributable is not installed on your machine, you will get the following error:
... VCRUNTIME140.dll was not found. ..

You can download the file from Microsoft Redistributable download

If all went well, you can use PHP from the command line. You can check the installation with the command: php -v and the result should be something similar:

To make working with PHP more convenient, you can put the PHP directory on the path. Click on start and just type env. From the list click on 'Edit the system environment variables' and the System Properties dialog will appear. Click the 'Environment Variables...' and select 'Path' from the System variables block. Add the new PHP folder to the list.

Now PHP is running but not yet configured properly. Configuring PHP 8 at the base level is no different from older versions.
The PHP folder contains 2 example configuration files:

• php.ini-production
• php.ini-development

Copy the development version to the same directory as php.ini and open this for editing. What you need to set is the location of the extensions and session data.

You have to set the extension_dir parameter to the valid location: extension_dir = 'c:Program FilesPHPphp-8.0.0RC2ext'

You also have to uncomment the required extensions from the list. Usually, the curl, gd, mbstring, mysqli, pdo_mysql extensions are required for complex php apps.

Finally, you need to set the location where to save the session data: session.save_path = 'w:/tmp'

Installing Apache

Even if PHP has a built-in web server, production systems use Apache, Ngnix, Lightspeed, and so on. For a Windows development environment, Apache is the easiest choice.

You can download the latest Apache webserver from the ApacheLounge website. Download the 32 or 64-bit version depending on your OS type.

As I mentioned before, I don't like everything in the C: root, so I also create a directory for Apache in the Program Files folder. Don't forget to allow permissions for the users.

Now you can copy the content of the Apache24 folder of the zip file to the new location. Pay attention to the exact directory structure.

As with PHP, you can add Apache to the path, but in this case, you need to add the bin folder.

Apache configuration files are located in the conf directory. The main config file is the httpd.conf . To start the webserver you need to set the server root (SRVROOT) parameter in the config file to the correct location as follows:

It is a good idea to set the ServerName explicitly to prevent problems during startup. As we will use virtual hosts later, you can simply set it to localhost:80

An optional step - but usually required by most PHP applications - to enable Apache modules. For example, the mod_rewrite module is disabled by default but almost always required. Just uncomment the line and you are done.

Install Apache as a service

To install Apache as a windows service, you have to open a command prompt as an administrator. Navigate to the Apache bin directory and execute the command: httpd -k install
Then you can start the webserver using httpd -k start

Allow access:

Php Mysql

If everything is correct, then you get the prompt back without any message.

Open a browser and type http://localhost as the URL. You should get a welcome page similar to this:

The default document location is the htdocsfolder in the installation directory. However, this is not optimal. If you are a developer, you probably work on multiple web projects. So it would be nice to have a dedicated folder and URL for each project. For example, if site1.com and site2.com are the production sites, then you probably want a site1.local and site2.local URLs with a dedicated target folder for your development.

Virtual hosts are the solution to this problem.
Again, it is a good idea to store your code separated from drive C.
For example, you can create a directory structure like this:

Now you have to configure virtual hosts and enable it. First, open the httpd.conf file and uncomment the line that includes the httpd-vhosts.conf file.

Then, open the httpd-vhosts.conf file that is in the extra folder. Add one entry for each project you want. The ServerName , DocumentRoot , and ErrorLog are the important parameters, you can skip the others.

Besides this, you have to allow access to these folders so add a common Directory block with the following content before the VirtualHosts entries.
Your final virtual host config file should look like this:

You also need to extend the Windows hosts file that is located in c:WindowsSystem32driversetchosts. Open the file for editing with administration privileges and add the server names used before to the file pointing to the local 127.0.0.1 IP address.

Put a simple index.html file in the site roots with different content for testing purposes.
Now you can restart Apache using httpd -k restart . If everything is correct, then no error message is displayed. Navigate to site1.local and site2.local, and your browser should display the corresponding Html content.

Setup Apache to use PHP 8

The setup is almost done, but we haven’t configured PHP and Apache to work together.
First, we have to add the php extension to the known mime types. To do this, add the following line at the end of the mime.types config file: application/x-httpd-php php

To execute the index.php automatically if a directory is requested, extend the DirectoryIndex property with index.php in httpd.conf .

After that, the most important step is to load the php module. To do this, specify the PHP install directory and the appropriate module in the httpd.conf file. Just insert the lines at the end of the httpd.conf :

Php 7 Vs 8

Now you can restart apache and check for any error. If everything is fine then create a small inf.php file in the server document root with a simple phpinfo like this:

Visiting site1.local/info.php should result in a PHP information page in your browser.

The 'Can't locate API module structure 'php8_module' in file ...' error message is a common problem. Verify that exactly php_module is in the LoadModule line. Neither the old php7_module nor the expected php8_module is good.

Video

This entry was posted in WordPress Security on November 23, 2020 by Ram Gall18 Replies

PHP 8.0 is set to be released on November 26, 2020. As the programming language powering WordPress sites, PHP’s latest version offers new features that developers will find useful and improvements that promise to greatly enhance security and performance in the long run. It also fully removes a number of previously deprecated functions. PHP 8 is a massive change from previous versions.

In this article, we hope to provide insights detailing what this means for WordPress site owners, including recommended adoption strategies.

Should I upgrade right away?

No. The upcoming major version of WordPress, 5.6, is intended to be “beta compatible with PHP 8” according to the November 18 WordPress dev chat. This means that most core WordPress functionality will work, but unexpected bugs may still occur for some time, even without the presence of additional plugins or themes. WordPress has called for additional testing with PHP 8 in order to find and fix as many remaining bugs as possible.

At Wordfence, our Quality Assurance team is working to ensure that our plugin is compatible with PHP 8 in a variety of environments. Upcoming Wordfence versions will offer a similar level of partial support, though we have additional testing planned to reach full compatibility.

A vast number of WordPress plugins and themes will not be immediately compatible with PHP 8. Those that do not run into fatal errors during normal usage may still show unexpected behavior for some time.

Php8r Puller

What breaking changes does this include?

Some developers have long argued that PHP is insecure by default. While this is up for debate, it’s true that versions of PHP prior to PHP 8 are more fault tolerant and try very hard to ensure that code will run even if minor errors are present.

PHP 8 uses much stricter typing than previous versions. Many built-in functions are now pickier about the input they accept, and PHP 8 itself is more stringent about how input is passed to functions. Issues that previously resulted in notices now result in warnings, and issues that previously resulted in warnings now result in errors.

In other words, PHP 8 is not as lenient as previous versions. It will not try quite as hard to make code work no matter what.

Some functions and features that were deprecated in PHP 7.x have been completely removed. These include:

• The $php_errormsg variable
• The create_function() function
• The mbstring.func_overload ini directive
• The real type
• The allow_url_include ini directive
• The restore_include_path() function
• The each() function

While most of these are no longer widely used, we have identified that create_function is still used in over 5,500 WordPress plugins, including extremely popular plugins with millions of installations. In some cases use of these deprecated functions may be intended for backwards compatibility with older versions of PHP. Many plugins, however, will need extensive refactoring as PHP 8 becomes more utilized.

Quite a few plugins and themes also depend heavily on third party libraries. WordPress developers may need to wait until these are updated for compatibility. If these libraries are not maintained or updated for compatibility with PHP 8, it may be necessary to fork these libraries, find alternatives, or even rewrite plugins and themes from the ground up.

For more in-depth information about what’s changed, our friends at Yoast have produced an excellent compatibility report intended for developers looking to ensure their software is compatible.

What security concerns are there?

PHP allows something called “Type Juggling.” This means that it can treat strings containing numbers the same way it treats integers or floats, and can perform math and do comparisons between these different types as long as the loose comparison operator is used instead of the strict comparison operator . For developers, Type Juggling can be very useful and save time when writing code, but it can sometimes lead to unusual behavior.

A classic example of how Type Juggling can cause issues is that comparing 0”blah” will return true. PHP 8 fixes this type of behavior so that these and similar comparisons (e.g., 0”0blah”) will return false.

By and large, this will actually improve security. There are a number of exploits that can take advantage of PHP’s Type Juggling behavior to bypass nonstandard cookie, nonce, or password checks. Nonetheless, a large number of plugins use these loose comparisons, sometimes for critical functions. In most cases these will continue to work correctly when using PHP 8, but a few of them might actually rely on incorrect behavior in order to function properly. In a few rare circumstances, this might open up new security holes.

The onus of updating code for compatibility with PHP 8 could prove to be too much for some developers, and many plugins and themes may end up abandoned, though this is less likely to happen for plugins and themes with a large install base. Any security issues in these abandoned plugins and themes would go unpatched, which could prove disastrous.

Likewise, many websites may remain on an insecure version of PHP in order to keep their legacy plugins running.

Finally, certain strains of malware rely on deprecated functions as well as PHP’s fault tolerance in order to obfuscate their intentions. These strains will cease to function or become more noticeable in a PHP 8 environment, but malware authors will adapt in time.

What performance changes are coming?

One potentially exciting feature coming to PHP 8 is JIT, or “Just In Time” compilation. PHP is an interpreted language, meaning that it is translated into machine code as it runs. JIT keeps track of code that’s frequently used and attempts to optimize the machine code translation so that it can be reused. This can result in a massive performance improvement for specific functionality.

The addition of JIT to other languages, such as JavaScript, has historically led to an explosion of new applications. For example, virtual machines running in JavaScript would have been unimaginable in the early days of the web. Certain tasks that would have required a module to be installed on the server in the past will become practical using pure PHP libraries.

For the time being, however, the actual performance improvement for web applications such as WordPress is minimal, and it will take a long time before the average WordPress user or developer reaps the benefits of this new feature.

While there are many other new features to make developers’ lives easier, it is unlikely that these will be used in WordPress plugins and themes for the foreseeable future, as most would break backwards compatibility with earlier versions of PHP still in use by many WordPress sites.

How long do developers have to update?

Each version of PHP has a life cycle of 2 years during which bugs are fixed, and an additional year during which security issues are patched. PHP 7.4 came out in November 2019. As the final version of PHP 7, this means that bugs in PHP 7.4 will be fixed until November of 2021, and security issues will be patched until November of 2022, at which point it will reach its “End of Life”. This means that November 2022 can be considered a hard cutoff date: all PHP code should be compatible with PHP 8.0 at minimum by this time, or risk being stuck on a potentially vulnerable version of PHP.

Conclusion

The transition to PHP 8 is one of the broadest and most impactful changes the language has ever seen. While it will be worth it in the long run, WordPress site owners and developers may be in for a rough ride in the short term. If you’re a website owner, start keeping a watchful eye on which of your plugins and themes are being updated or tested for compatibility and make a plan to replace the ones that aren’t. If you’re a developer, start testing your code and any dependencies on PHP 8, if you’re not already, and start making a plan to fork or replace any libraries that aren’t being updated. The WordPress ecosystem has been through difficult transitions in the past, and our open-source community has always grown and adapted.

Special thanks to QA Lead Matt Rusnak and Lead Developer Matt Barry for their assistance with this article.