问题
We are running php 5.3.27 on Windows, nts.
We just failed a PCI scan due to a session fixation vulnerability in PHP and need to regain PCI compliance.
It is a little frustrating, as we use session_regenerate_id() after login, so in my eyes (perhaps I am wrong) our application is not vulnerable even if php is.
To pass the scan we need to upgrade to php 5.5.2.
We use the sqlsrv driver extension from Microsoft, and I notice that they have not released a build for php 5.5.x
Does anyone have a production viable solution for this issue?
______update___________
I have found this http://social.msdn.microsoft.com/Forums/sqlserver/en-US/e1d37219-88a3-46b2-a421-73bfa33fe433/unofficial-php-55-drivers-x86 which is a non vendor build.
Has anyone used this build in production?
Thanks
回答1:
There's an unofficial driver. Not sure if that will pass PCI.
http://social.msdn.microsoft.com/Forums/sqlserver/en-US/e1d37219-88a3-46b2-a421-73bfa33fe433/unofficial-php-55-drivers-x86
回答2:
The official Microsoft Drivers for PHP for SQL Server 3.1 is out on 2014-12-12 (see http://www.microsoft.com/en-ca/download/details.aspx?id=20098 ). It supports PHP 5.4.32, or PHP 5.5.16, or later, according to page.
来源：https://stackoverflow.com/questions/18721223/microsoft-sqlsrv-extension-for-php-5-5-x