Hosting PHP web application on Windows Server

To host a PHP application on a windows server follow these steps

Install IIS on windows server

On Windows Server 2012 machine

1. On the Start page, click the Server Manager tile, and then click OK.
2. In Server Manager, select Dashboard, and click Add roles and features.
3. In the Add Roles and Features Wizard, on the Before You Begin page, click Next.
4. On the Select Installation Type page, select Role-based or Feature-based Installation and click Next
5. On the Select Destination Server page, select Select a server from the server pool, select your server, and click Next.
6. On the Select Server Roles page, select Web Server (IIS), and then click Next.
7. On the Select Features page, note the preselected features that are installed by default, and then select CGI. This selection also installs FastCGI, which is recommended for PHP applications.
8. Click Next.
9. On the Web Server Role (IIS) page, click Next.
10. On the Select Role Services page, note the preselected role services that are installed by default, and then click Next.
11. On the Confirm Installation Selections page, confirm your selections, and then click Install.
12. On the Installation Progress page, confirm that your installation of the Web Server (IIS) role and required role services completed successfully, and then click Close.
13. To verify that IIS installed successfully, type the following into a web browser:
    http://localhost or http://127.0.0.1
    You should see the default IIS Welcome page. 

On Windows 8 machine

1. On the Start page, type Control Panel, and then click the Control Panel icon in the search results.
2. In Control Panel, click Programs, and then click Turn Windows features on or off.
3. In the Windows Features dialog box, click Internet Information Services, note the preselected features that are installed by default, and then select CGI. This selection also installs FastCGI, which is recommended for PHP applications.
4. Click OK.
5. To verify that IIS installed successfully, type the following into a web browser:
   http://localhost
   You see the default IIS Welcome page.

 Install PHP

using Web Platform Installer (Web PI)

1. Open a browser to the following website: Microsoft Web Platform Installer 3.0.
2. Click Download It Now, and then click Run.
3. At the top of the Web Platform Installer window, click Products.
4. Click Frameworks, and then select the current version of PHP. (At this writing, the current version is PHP 5.3.13.)
5. Click Install.
   The Web Platform Installation page displays the version of PHP and its dependencies that will be installed.
6. Click I Accept.
   Web PI installs the PHP packages.
7. Click Finish.

 Manual PHP installation

1. Download PHP and the WinCache extension.
2. Install PHP and WinCache.
3. Add the PHP installation folder to the Path environment variable.
4. Set up a handler mapping for PHP.
5. Add default document entries for PHP.
6. Test your PHP installation.

To keep this procedure simple, install the WinCache extension but do not configure it. You will configure and test WinCache later

Download and install php

1. Open your browser to Windows for PHP Download Page and download the PHP 5.3 non-thread-safe zip package.

2. Caution
   The PHP 5.4 version does not work with the WinCache extension version 1.1. Use PHP 5.3 until this problem is resolved.

3. Download the WinCache extension (Php_wincache-svn20110402-5.2-nts-vc6-x86.zip) from the List of Windows Extensions for PHP.
4. Extract all files in the PHP .zip package to a folder of your choice, for example C:\PHP\.
5. Extract the WinCache .zip package to the PHP extensions folder (\ext), for example C:\PHP\ext.
   The WinCache .zip package contains one file (Php_wincache.dll).
6. Open Control Panel, click System and Security, click System, and then click Advanced system settings.
7. In the System Properties window, select the Advanced tab, and then click Environment Variables.
8. Under System variables, select Path, and then click Edit.
9. Add the path to your PHP installation folder to the end of the Variable value, for example ;C:\PHP. Click OK.
10. Open IIS Manager, select the hostname of your computer in the Connections panel, and then double-click Handler Mappings.
11. In the Action panel, click Add Module Mapping.
12. In Request path, type *.php.
13. From the Module menu, select FastCgiModule.
14. In the Executable box, type the full path to Php-cgi.exe, for example C:\PHP\Php-cgi.exe.
15. In Name, type a name for the module mapping, for example FastCGI.
16. Click OK.
17. Select the hostname of your computer in the Connections panel, and double-click Default Document.
18. In the Action panel, click Add. Type Index.php in the Name box, and then click OK.
19. Click Add again. Type Default.php in the Name box, and then click OK.

test php install installation

1. Open a text editor, for example Notepad, as Administrator.
2. In a new file, type the following text:
3. Save the file as C:\inetpub\wwwroot\Phpinfo.php.
4. Open a browser and enter the following URL: http://localhost/phpinfo.php
   A nicely formatted webpage is displayed showing the current PHP settings.

Add php application

Once you have IIS and PHP installed, you can add a PHP application to your web server. This section describes how to set up your PHP application on an IIS web server with PHP installed. It does not explain how to develop a PHP application.

1.  Open IIS Manager.

• For Windows Server 2012, on the Start page click the Server Manager tile, and then click OK. On the Server Manager Dashboard, click the Tools menu, and then click Internet Information Services (IIS) Manager.
• For Windows 8, on the Start page type Control Panel, and then click the Control Panel icon in the search results. On the Control Panel screen, click System and Security, click Administrative Tools, and then click Internet Information Services (IIS) Manager.

1. In the Connections pane, right-click the Sites node in the tree, and then click Add Website.
2. In the Add Website dialog box, type a friendly name for your website in the Site name box.
3. If you want to select a different application pool than the one listed in the Application Pool box, click Select. In the Select Application Pool dialog box, select an application pool from the Application Pool list and then click OK.
4. In the Physical path box, type the physical path of the website's folder, or click the browse button (...) to navigate the file system to find the folder.
5. If the physical path that you entered in step 5 is to a remote share, click Connect as to specify credentials that have permission to access the path. If you do not use specific credentials, select the Application user (pass-through authentication) option in the Connect As dialog box.
6. Select the protocol for the website from the Type list.
7. The default value in the IP address box is All Unassigned. If you must specify a static IP address for the website, type the IP address in the IP address box.
8. Type a port number in the Port text box.
9. Optionally, type a host header name for the website in the Host Header box.
10. If you do not have to make any changes to the site, and you want the website to be immediately available, select the Start Web site immediately check box.
11. Click OK.

configure wincache

To configure the WinCache PHP extension

1. In Windows Explorer, open your PHP installation folder, for example C:\PHP.
2. Choose either the php.ini - development or php.ini - production file, and rename it php.ini.
3. In a text editor, open the php.ini file and added the following line at the end of the file: extension = php_wincache.dll.
4. Save and close the php.ini file.
5. Recycle the IIS Application Pools for PHP to pick up the configuration changes.

To view WinCache configuration and other PHP settings

1. Open a text editor.
2. In a new file, type the following text:
3. Save the file as c:\inetpub\wwwroot\phpinfo.php.
4. Open a browser and enter the following URL: http://localhost/phpinfo.php
   A nicely formatted web page is displayed showing the current PHP settings. The WinCache settings appear in a section called wincache.

Warning
Delete the phpinfo.php file when it’s no longer needed.

Configure other PHP settings

To configure a PHP setting

1. In Windows Explorer, open your PHP installation folder, for example C:\PHP.
2. In a text editor, open the php.ini file.
3. Search the file for the setting you want to change.
   If the setting is commented out (line begins with a semicolon [;]), delete the semicolon and set the value. If you can’t find the setting, add the line to the end of the file.
4. Save and close the php.ini file.
5. Recycle the IIS Application Pools for PHP to pick up the configuration changes.

configure PHP extensions

To configure a PHP extension

1. Download the PHP extension you want from the list of Windows extensions for PHP.
2. Extract the extension zip package to the PHP extensions folder (\ext), for example C:\PHP\ext.
3. In Windows Explorer, open your PHP installation folder, for example C:\PHP.
4. In a text editor, open the php.ini file.
5. Search the file for the extension you want to configure.
   If the extension is commented out (line begins with a semicolon [;]), delete the semicolon. If you can’t find the extension, add it to the end of the file. A line that adds an extension is in the form: extension = extension_name.dll. For example: extension = php_soap.dll.
6. Save and close the php.ini file.
7. Recycle the IIS Application Pools for PHP to pick up the configuration changes.

configure PHP security settings

To configure a PHP setting for security

1. In Windows Explorer, open your PHP installation folder, for example C:\PHP.
2. In a text editor, open the php.ini file.
3. Search the file for the setting you want to change.
   If the setting is commented out (line begins with a semicolon [;]), delete the semicolon and set the value. If you can’t find the setting, add the line to the end of the file.
4. Save and close the php.ini file.
5. Recycle the IIS Application Pools for PHP to pick up the configuration changes.

Isolate Web Applications

---

Implement the following recommendations to isolate websites and web applications on your server.

• Use one application pool per website or web application.
• Limit access to site folders and files to the application pool identity.
• Set up a separate PHP temp folder per site and only give access to the application pool identity.
• Make sure to set an ACL (access control list) on each site root to allow only access to the application pool identity.

If you have more than one application per application pool, consider creating enough application pools and moving some of the applications to the new pools.

To create an application pool

1. Open IIS Manager.
2. In the Connections pane, click Application Pools.
3. In the Actions pane, click Add Application Pool.
4. In the Name box, type a unique name for the application pool.
5. Under .NET Framework version, select No Managed Code.
6. Select the Managed pipeline mode. The Integrated mode is recommended.
7. Click OK.

To move an application to another application pool

1. Open IIS Manager.
2. In the Connections page, select the website or web application you want to move.
3. In the Actions pane, click Basic Settings.
4. On the Edit Site dialog, click Select to open the Select Application Pool dialog, and then select the application pool from the Application pool menu.
5. Click OK to close the Select Application Pool dialog, and click OK to close the Edit Site menu.

To add an application pool identity to a folder or file ACL

1. Open Windows Explorer and navigate to the folder or file.
2. Right click the folder or file, and then click Properties.
3. Select the Security tab, and then click Edit.
4. Click Add, click Locations, and select your server as the location to search.
5. In the Enter the object names to select box, type IIS APPPOOL\applicationPoolName, where applicationPoolName is the application pool identity.
6. Click OK, click OK, and click OK again to close the dialogs.

Enable Per-site PHP Configuration

---

When you have multiple PHP applications on an IIS web server, you can improve security by configuring a PHP process pool and a php.ini file for each application. This section explains how to configure process pools and multiple pnp.ini files by using an applicationHost.config file.

Per-site PHP Process Pools

---

When each website has its own application pool, which is a recommended practice on IIS, it is possible to associate a dedicated FastCGI process pool with each website. This association is done in the fastCgi section of the applicationHost.config file. A FastCGI process pool is uniquely identified by the combination of fullPath and arguments attributes of the application element. To create several FastCGI process pools for the same process executable, such as php-cgi.exe, use the arguments attribute to distinguish the process pool definitions. With php-cgi.exe processes, use the command line switch "-d" to define an INI entry for a PHP process. And use this switch to set a PHP setting that makes the arguments string unique.
For example, if there are two Web sites "website1" and "website2" that must have their own set of PHP settings, define the FastCGI process pools as follows:

Copy

In this example the PHP setting open_basedir is used to distinguish between the process pool definitions. The setting also enforces that the PHP executable for each process pool can perform file operations only within the root folder of the corresponding website.
Therefore, the PHP handler mapping for website1 is as follows:

Copy

And the handler mapping for website2 is as follows:

Copy

Specifying Php.ini Location

---

When the PHP process starts, it determines the location of the configuration php.ini file by using various settings. The PHP documentation provides a detailed description of the PHP startup process. One of the places where the PHP process searches for the php.ini location is the PHPRC environment variable. If the PHP process finds a php.ini file in the path that is specified in this environment variable, it will use it. Otherwise, the PHP process will revert to using the default location of the php.ini file. This environment variable can be used to allow hosting customers to use their own versions of php.ini files.
For example, if there are two websites, "website1" and "website2," that are located at the following file paths: C:\WebSites\website1 and C:\WebSites\website2, you can configure the php-cgi.exe process pools in the fastCgi section of the applicationHost.config file as follows:

Copy

This way website1 can have its own version of the php.ini file that is located in the C:\WebSites\website1, while website2 can have its own version of the php.ini file that is located in C:\WebSites\website2. This configuration also ensures that if a php.ini file cannot be found in the location that is specified by the PHPRC environment variable, then PHP will use the default php.ini file that is located in the same folder where the php-cgi.exe is located.