Use information disclosure to gather PHP configuration statistics

Damien Seguy from nexen.net sent an e-mail with a notice about his newest statistics project: „PHP configuration statistics“. He gathered output of around 12,000 public available phpinfo() scripts.

Some of the results of his investigations:

Here are some funny and not so funny stats.

• PHP admins likes to compile PHP in Summer
• Register global is not dead
• memory_limit is not used
• PHP apps handle 100 Mb files

The first part of his article is online in English. Thank you Damien!

The not so funny side: please secure your phpinfo() output scripts! Either by using not so common script names like phpinfo.php, by protecting it through .htaccess or other mechanisms or by simply not uploading a phpinfo() script on your server.