PHP 5.3 received its final release yesterday, and the PHP project will not fix flaws found from now on. Find out which version the site uses, try a copy on 5.4 or 5.5, then switch.

The last release of PHP 5.3

Yesterday the PHP project released version 5.3.29 and said it is the last release of the 5.3 series. No further updates are planned, security fixes included.

PHP is the programming language behind a great many small business websites. WordPress, Joomla and Drupal run on it, as do contact forms, galleries and booking scripts written years ago.

Many of those sites still run on 5.3, because it was the version their host installed when the account was opened, and nothing has prompted a change since.

What end of life means

End of life does not mean the site stops working. It will run tomorrow exactly as it ran today.

It means that when someone finds a new flaw in PHP 5.3, the PHP project will not fix it. Attackers read the same security announcements, and an unpatched flaw in a widely used version is worth their effort.

On shared hosting the risk is shared too. One PHP installation usually serves many accounts on the same server, so the host has its own reasons to move everyone along.

Finding out which version you run

There are a few ways to see which version of PHP a site uses:

Delete any test file straight after reading it. A page listing your server's settings is useful to an attacker too.

Note the exact number. 5.3.3 and 5.3.29 are both 5.3, but years of fixes apart, and the difference matters when you talk to the host.

Why an upgrade needs testing

Moving a site from 5.3 to 5.4 or 5.5 is usually a setting in the control panel. The risk lies in what the change does to old code.

PHP 5.4 removed several old features that early scripts relied on, such as automatic global variables and magic quotes. Code that leaned on them can stop with an error or quietly behave differently.

PHP 5.5 flags the oldest way of talking to a database as out of date, so scripts using it can print warnings on the page. Old add-ons trip over the same changes.

Test on a copy first

The safe way is to copy the site to a test address on the same hosting, switch only the copy to the newer version, and work through it.

Open every type of page, submit every form, run a search, place a test order if the site sells, and log in to the editing area. Then read the error log for warnings that never reach the screen.

Fix what breaks on the copy, switch the live site, and test it again. Keep a note of how to switch back if something was missed.

Update the software at the same time

A site still on PHP 5.3 often runs an old version of its own software too. Update WordPress or Joomla, the theme and every add-on on the copy before the switch.

Current versions are written for current PHP. An add-on with no update for several years is the likeliest thing to fail, and the best candidate for replacing.

Before starting, back up the site's files and its database, and store that copy somewhere away from the hosting account.

A worked example

A log home builder in the Interior has a site built some years ago: a gallery of finished homes, a page for each floor plan and a form for requesting a quote.

Its host had kept the account on PHP 5.3 since it was opened. With the end of life approaching, the owner asked the developer who maintains the site what an upgrade would involve.

On a copy switched to PHP 5.5, the gallery showed a blank page. Its script, written for the original build, passed values to functions in a way PHP 5.4 no longer accepts.

The quote form looked fine but sent nothing, because it kept visitors' details using an old session method that had been removed.

The developer rewrote both scripts, tested every page and form on the copy, and switched the live site on a weekday morning, with a note of how to switch back.

Questions for your host

Ask your host three things: which PHP versions it offers, whether you can choose the version for each site, and when it plans to retire 5.3 on your server.

Many shared hosts let you choose the version in the control panel, sometimes even for a single folder, which makes testing on a copy straightforward.

If the host offers nothing newer than 5.3, that is a question about the hosting itself, and worth raising now rather than after the next security notice.

A switch you did not choose

Hosts cannot keep an unsupported version forever. Some will move every account to a newer version themselves, after emailing a notice to the account's contact address.

If that notice goes to an old address, or nobody reads it, the first sign is a broken form or a blank page on a day nobody planned for.

The counter-case

Some hosts run PHP from a server operating system with long-term support, whose maker keeps patching its own copy of an older version for years. There the number looks old, but the fixes continue.

A site made only of static HTML pages has no PHP in it, and nothing here to upgrade.

Even so, ask rather than assume. A host that backports fixes can say so in writing, and a site with any form, shop or login almost certainly runs PHP somewhere.

Moving off PHP 5.3

  1. Find the PHP version your site runs, to the last digit.
  2. Ask the host what it offers and its plans for 5.3.
  3. Copy the site to a test address on the same hosting.
  4. Update the software, theme and add-ons on the copy.
  5. Switch the copy to 5.4 or 5.5 and test everything.
  6. Fix what breaks, then switch the live site.
  7. Note how to switch back if anything was missed.

Step three turns a risky change into a routine one. Every fault found on the copy is a fault your customers never see.

If the answers lead to a move to another host, nameservers still pointing at a host you left sets out the order of changes that keeps the site and email running.

Frequently asked questions

What does PHP 5.3 end of life mean?

The PHP project made its last 5.3 release on August 14. Flaws found from now on will not be fixed by the project, though sites keep working as before.

How do I find out which PHP version my site uses?

Look in the hosting control panel, ask the host's support desk, or have your developer check. Any test file that prints settings must be deleted straight away.

Will my site break when PHP is upgraded?

It may. PHP 5.4 removed features some older scripts rely on, and 5.5 warns about an old way of using databases. Testing a copy first shows what breaks.

Should I move to PHP 5.4 or 5.5?

Usually the newest version your host offers that your site's software supports. Your developer can check the site's code against it on a test copy.

Is PHP 5.3 safe if my host backports fixes?

It can be. Some server operating systems keep patching their own copy for years. Ask the host to confirm in writing that this applies to your server.

Does a plain HTML site need to worry?

Not if it truly has no PHP. Any contact form, shop, login or editing system almost certainly uses it, so check before assuming the site is unaffected.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Site still running on PHP 5.3?

Tell us where the site is hosted, and we will check its PHP version and plan a tested move to a supported one.

Start a Conversation