Feed Sign in with OpenID OpenID

Simon Willison’s Weblog

PHP and Apache 2.0

For as long as Apache 2 has been stable, the PHP manual has carried this strongly worded warning:

Do not use Apache 2.0 and PHP in a production environment neither on Unix nor on Windows.

I’ve frequently wondered why they are being so slow to support the new version —after all, Apache 2 provides a bunch of improvements over the older 1.3 and is recommended by the Apache Software Foundation as the best available version.

I finally found the answer today in this comment buried on Slashdot. It seems that one of the key features of Apache 2 is the new threaded worker module which uses threads to serve more requests more efficiently than 1.3’s multi-process based server. While the core Zend engine of PHP is thread-safe many of the critical libraries that PHP relies on for its advanced functionality (image processing, database connectivity and so forth) are not, and are unlikely to become so any time in the future. In a threaded environment PHP is likely to suffer from all kinds of unpredictable bugs. Apache 2 can be run in traditional 1.3-style prefork mode but doing so greatly reduces its advantages over 1.3. Combined with the lack of heavy duty testing on Apache 2 and the fact that the 1.3 series will continue to be supported for a long time to come it’s clear why the PHP team are unwilling to recommend PHP and Apache 2 in a production environment.

This is PHP and Apache 2.0 by Simon Willison, posted on 31st March 2004.

View blog reactions

Next: 1GB of webmail from Google

Previous: Omit needless words, codified

26 comments

  1. And why does Apache 1.3 continue to be so heavily used? Could it be because users cannot afford to migrate to Apache 2, if doing so will break PHP?

    Jacques Distler - 31st March 2004 08:11 - #

  2. RedHat Enterprise ships with PHP and Apache 2 and it works fine. So it does work fine with the pre-fork mode. In my experience, it works better (faster, fewer crashes/errors), though not enough to justify upgrading an older server. Owen

    Owen - 31st March 2004 08:15 - #

  3. Apache 2 still has a number of advantages over 1.3, not least it's proper ability to filter output. Want to pipe your PHP page through a mod_perl and then gzip it before sending it to the browser? No problems. It also has a better API, although that's not much of an issue to the average user.

    Whilst threads are sold as a performance improvement, they're often not, particularly in a Unix/Linux environment. The forking model really does work very well, which along with inertia is enough to explain why people aren't moving from apache 1.3.

    Have a look at the new features list, though. You might find something of interest.

    -Dom

    Dominic Mitchell - 31st March 2004 08:33 - #

  4. Trust me to point you at something that's already linked in the post. I should know not to post when I've just woken up...

    -Dom

    Dominic Mitchell - 31st March 2004 08:35 - #

  5. Owen as of about 2.0.45 it apache runs fine in prefork mode. before that it was a slower, unstable version of 1.3.x. After 45 it is about on par with 1.3, so there isnt much requirement to upgrade to 1.3 if its already installed

    Adam Ashley - 31st March 2004 08:36 - #

  6. In my experience, Apache 2 Prefork and PHP 4.3 are stable. I'm really impatient for PHP to be suitable for the Perchild MPM though, as you can then run PHP scripts under a different user for each virtual host using the AssignUserID directive.

    Jim Dabell - 31st March 2004 10:42 - #

  7. Jim --

    Read the posting again. It's not PHP that's unsuitable for the Perchild MPM. It's the libraries you've linked into PHP. If all your third-party libraries are thread safe, then you can safely use the Perchild MPM. (Or, you'll at least uncover valid PHP threading bugs.)

    Adam Trachtenberg - 31st March 2004 16:29 - #

  8. Sorry, yes, I was a bit imprecise with my wording - what I meant was that I am impatient for PHP and all the extra libraries I use to work.

    I've had problems using Perchild under FreeBSD regardless of any third-party libraries anyway, which is a showstopper for me.

    Jim Dabell - 31st March 2004 16:46 - #

  9. And why does Apache 1.3 continue to be so heavily used? Could it be because users cannot afford to migrate to Apache 2, if doing so will break PHP?

    I use Apache 1.3 on many servers because there isn't a stable release of mod_perl for Apache 2 yet. However, I also use Apache 2 with PHP on production servers but without the threaded MPM. I stick to the good old prefork model for my Apache 2 production servers for now. Maybe someday I'll trust the threaded model enough to upgrade.

    Scott Johnson - 31st March 2004 20:34 - #

  10. MPM_Perchild is still bad mojo, afaik. I was super duper excited about it, but as of a couple months ago it was not in a functional state and didn't appear to be getting any attention.

    Ed Finkler - 1st April 2004 01:41 - #

  11. I use Apache2, of course without the threaded MPM. I'm very curious.. Which modules/libraries for PHP arent safe in per-child mode? Is there a known list somewhere?

    iamsure - 1st April 2004 07:25 - #

  12. I'm never one to listen to good advice ;-) I've been running Apache2 and PHP (under Windows 2000) on commerical servers for ages (at least 6 months I think) - with ZERO problems. None, Nada, Zilch, Zip. I wish I could say the same for every piece of software I used.

    Richard@Home - 1st April 2004 10:08 - #

  13. Richard, do you know which features/libraries you're using in that "risky" configuration?

    Jeremy Dunck - 1st April 2004 18:58 - #

  14. It is mistaken to place the blame on non-threadsafe libraries. You don't blame libc for the erroneous use of localtime instead of localtime_r by someone coding a multithreaded application in C. Why should you not blame instead the coder of the php application if she does not use a critical section when required? You can write buggy code in any language. PHP is not more or less susceptible to races and deadlocks than C++ or Java -- or at least, if it is, that has yet to be demonstrated by an objective metric.

    Tony Kimball - 2nd April 2004 04:36 - #

  15. To be honest Jeremy, I use probably only 15% of the features of php - and probably on 10% of apache2. For example, I don't use PHP to generate images dynamically (I've never had much look getting the graphics libraries to work under windows) and I've shyed away from OOP as I'm waiting for PHP5 much better implementation.

    I also religiously comment out any apache2 modules that I know I'm not using. At the moment, the only ones enabled are (on the machine I'm looking at now): access_module, actions_module, alias_module, autoindex_module, cgi_module, dir_module, env_module, headers_module, log_config_module, mime_module, negotiation_module, setenvif_module and deflate_module.

    A couple of those mods (dir_module for intance) are there for debuging purposes and are not enabled on the main servers.

    Also, I barely ever use 3rd party code. From time to time, I may get my inspiration from a 3rd party product and have a look how they are doing things, but in the end everything gets coded by hand and tested.

    Most of my commercial work plugs into either SQL Server (via the odbc_ statements) or MySQL (via mysql_). I don't use a 3rd party DB extraction layers as I'm quite comfortable with ODBC (its as abstract as I need it to be).

    Let me know if there's anything else you'd like to know.

    Richard@Home - 5th April 2004 15:51 - #

  16. Someone must know WHICH PHP libraries ARE safe to use with Apache 2.0. Has anyone seen a list? I would hate to find out it just a handful of obscure, seldom used modules that were holding us all up.

    Rick Overman - 6th April 2004 18:50 - #

  17. I've been using PHP for a long time, but this issue had me looking for alternatives. We are now using apache2 on solaris9, and solaris is really great at threading, so its a waste to keep apache2 in prefork mode. I didn't look *too* closely at alternatives just yet -- is python thread-safe for use with threaded apache2? Thanks.

    Brent Kearney - 6th April 2004 21:28 - #

  18. I have tips for using PHP with Apache 2 at: http://www.google.com/

    As said above, the key is to use the multiple processes model, not the multi-threading model when building Apache 2. HTH.

    Dan Anderson - 22nd April 2004 00:31 - #

  19. I've run PHP and Apache 2 for well over a year in a high-traffic, mission critical production environment, have had absolutely no problems. I'd be interested to know exactly which modules are causing people problems... Jason

    Jason - 23rd May 2004 08:40 - #

  20. I don't believe that there is a list of which modules are not thread-safe. As Rasmus has said, determining the thread-safety of a piece of code is non-trivial (i.e. difficult and time-consuming). In addition, you cannot just run the code in a threaded environment and judge its thread-safety by whether it crashes or not; deadlocks between threads (race conditions) usually happen semi-randomly. Therefore, you will probably never see an official list of "safe" modules.

    Devin - 27th May 2004 23:36 - #

  21. But I was reading that Apache 1.3 for windows is already multi-threaded. So - is that a problem to use with PHP? What excat multi-threading issues are of concern - for example, with respect to tthe database: is it the connectivity to the database that is an issue or is it the actual consistency of the data in case of multiple writes? Thanks

    Shalini - 29th June 2004 20:35 - #

  22. This serious Apache 2.0 bug also affects PHP, amongst other modules.

    Rich.

    R Jones - 10th November 2004 09:28 - #

  23. I've been using Apache2 with PHP 4.x (latest version) with mcyrpt libraries and it takes 30 seconds on average to load a page on a server with more beef than a cattle ranch.

    Zeashan P - 6th September 2005 21:41 - #

  24. There are a number of comments in this thread and elsewhere to the effect that "I've run Apache 2 with multithreading and PHP in a production environment and haven't run into any problems". Whilst this may be true and it is always helpful for people to post their actual experiences, these comments really don't provide any useful information about how stable PHP will be for other users.

    The problem is that PHP links to a very large number of third party libraries, and any of these may be unsafe to run in a multi-threaded server. The peculiar features of threading bugs include that they only show up intermittently or even rarely, they only appear when the server is under load, and never in a development environment, that they are therefore extremely difficult to track down, that they never cause useful error messages, and that they often have fatal results for the user's workflow and/or data. In other words they are a damn nightmare for anyone trying to build reliable applications. It may very well be that you can use the vast majority of PHP libraries, the vast majority of the time without encountering any threading problems, but sensible programmers will stay well clear of doing so, until they have reassurances from the PHP and/or library developers that the software is reliable in a multi-threaded environment. To do otherwise is to invite catastrophic bugs that will be practically impossible to fix. If there's one thing that makes the onerous task of debugging your own complex web application a real hell on earth it's the suspicion that intermittent bugs might be caused not by your application code but by problems in the underlying interpreter.

    Oliver Crow - 4th February 2006 19:31 - #

  25. I have tried the two (Apache 2.0 and PHP 5)on my FreeBSD linux server and they do not together at all.The better combination is Apache 2.0 and PHP 4.3.0 or else go back to Apache 1.3.

    Mojela MOopisa - 21st February 2006 06:11 - #

  26. I have tried this combination guys (apache 2.0,mysql 4.1.13 and PHP 5.1.2 )on my Unix system and the combination is just doing fine.If you have a problem with undefined symbols-i can help.

    Mojela Moopisa - 8th March 2006 06:30 - #

Comments are closed.

Previously hosted at http://simon.incutio.com/archive/2004/03/31/phpAndApache2

A django site