# Running Drupal 6 with PHP 5.3 and Maintaining Security [closed]

I have a number of Drupal 6 sites that I can't upgrade at this time due to sheer lack of time to do so (it would be a major overhaul). Therefore, I am required to continue running PHP 5.3 on my server, but it is already EOL, and there are security fixes that have not been applied to it.

Are there other people here that are using Drupal 6 and PHP 5.3, while keeping their PHP secure? If so, how are they doing it? Is there a source for PHP 5.3 with backported security fixes, like an LTS version? I've seen Zend's version of that, but can't afford it. I saw Red Hat has RPMs with some security fixes backported into PHP 5.3, but not the most recent ones, at least as far as I can tell.

## closed as too broad by kiamlaluno♦Apr 21 '15 at 8:08

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

• I'm using php 5.4 & pressflow with some patches that fix the notices. – mikeytown2 Apr 13 '15 at 20:46
• @mikeytown2: Are there patches to make PHP 5.4 compatible with Views, though? From what I understood from drupal.org/node/2336585, the D6 version of that module produces blank output when run on PHP 5.4. – Evan Donovan Apr 13 '15 at 20:48

Here are the patches I'm using for D6. Some of these issues will have been committed, thus they don't need a patch anymore.

Views
http://drupal.org/node/853864#comment-6465560 - views_get_default_view() - race conditions and memory usage
http://drupal.org/node/402944#comment-4650020 - Persistent caching for unpack_options() calls from building displays
http://drupal.org/node/1372388#comment-5370432 - Inline/Remove recursion in views_object->unpack_options to improve performance
http://drupal.org/node/465332#comment-4756670 - Strict warning: non-static method should not be called statically
http://drupal.org/node/893128#comment-4894754 - Strict warning: Declaration of * should be compatible with that of views_handler::*
http://drupal.org/node/1265138#comment-4928988 - Notice: Undefined variable: teaser in views_plugin_row_node_rss->render()
http://drupal.org/node/1432242#comment-5807802 - Notice: Undefined index: size in views_db_object->export_row()

Views Bonus Pack
http://drupal.org/node/1223910#comment-4756506 - Strict warning: is_a(): Deprecated

Views Bulk Operations
http://drupal.org/node/1782662#comment-6469236 - Notice: Undefined index: HTTP_USER_AGENT in views_bulk_operations_form()

Views Datasource
http://drupal.org/node/1265190#comment-4929150 - Notice: Undefined property: stdClass::$name in views_plugin_style_xml->option_definition() Views Slideshow JCarousel http://drupal.org/node/1885586#comment-6926004 - php notices Here are some of the more popular modules as well Calendar http://drupal.org/node/999514#comment-4761150 - Strict warning errors for views plugins CCK http://drupal.org/node/1118792#comment-4358322 - array_keys() expects parameter 1 to be array, null given in content_multigroup.node_form.inc http://drupal.org/node/1244534#comment-4845816 - Notice: Undefined index http://drupal.org/node/1247732#comment-4857954 - Undefined index: _remove http://drupal.org/node/1156096#comment-4868230 - Notice: Undefined index: title/description in content_storage() http://drupal.org/node/1251146#comment-4871780 - Notice: Undefined index: #children in template_preprocess_content_field() http://drupal.org/node/1251160#comment-4871816 - Notice: Undefined index: #field_info in fieldgroup_form_alter() http://drupal.org/node/1265080#comment-4928778 - Notice: Undefined property: stdClass::$broken in content_handler_field->render()
http://drupal.org/node/1316510 - fix undefined index '#id' notice in form_alter hooks
http://drupal.org/node/533610#comment-5157454 - Notice: Undefined index: safe in theme_text_formatter_default()
http://drupal.org/node/1762506#comment-6411880 - Notice: Undefined property: stdClass::$field_* in content_rules_field_has_value() CTools http://drupal.org/node/1226098#comment-4765262 - Strict warning: Only variables should be passed by reference http://drupal.org/node/1334894#comment-5215962 - Warning: Invalid argument supplied for foreach() in views_content_views_content_type_render() http://drupal.org/node/1510118#comment-5807950 - Strict warning: Creating default object from empty value in views_content_views_content_type_admin_info() Context http://drupal.org/node/866208#comment-4845268 - Notice: Undefined property: stdClass::$taxonomy in context_node_condition() on line 352

Date
http://drupal.org/node/802722 - Extra comma in output when using "display from and to dates" on Display fields configuration
http://drupal.org/node/1223956#comment-4756746 - Strict warning: Creating default object from empty value in date_handler_fields
http://drupal.org/node/1948238#comment-7200236 - Strict warning: Declaration of date_handler_field_multiple::pre_render()

Features
http://drupal.org/node/1516900#comment-5833834 - Notice: Undefined index: group in views_handler_dependencies()
http://drupal.org/node/1515878#comment-5833794 - Strict warning: Only variables should be passed by reference in content_features_rebuild()

FileField
http://drupal.org/node/1180508#comment-4872304 - Warning: array_merge() Argument #2 is not an array in filefield_widget()
http://drupal.org/node/1164892#comment-4500360 - Warning: Trying to get property of non-object in filefield_field_sanitize()
http://drupal.org/node/1317424#comment-5146998 - Notice: Undefined index: fid in filefield_widget_process
http://drupal.org/node/1415840#comment-5514392 - Fatal error: Cannot unset string offsets
http://drupal.org/node/1677208#comment-6213652 - Notice: Undefined index: data in theme_filefield_widget_preview
http://drupal.org/node/1775708#comment-6440138 - Notice: unserialize(): Error at offset 0 of 1 bytes in filefield_get_node_files()

ImageAPI
http://drupal.org/node/1189884#comment-4608576 - Allow for custom code to be inserted into the convert command before it is ran
http://drupal.org/node/1201914#comment-4663120 - Add in the ability to "nice" the convert process
http://drupal.org/node/1250348#comment-4868656 - Fix divide by zero errors.
http://drupal.org/node/1766064#comment-6434498 - User error: ImageMagick reported error code 1. Message: convert: no encode delegate for this image format

Imagecache
http://drupal.org/node/1243258#comment-4841244 - use lock.inc instead of a file lock
http://drupal.org/node/1761108#comment-6407780 - Notice: Undefined index: filepath in theme_imagecache_formatter_default()

jQuery Update
http://drupal.org/node/1067290#comment-6516884 - Fix jQuery 1.7 for Drupal 6

Rules
http://drupal.org/node/1250384#comment-4868884 - Strict warning: Only variables should be passed by reference in rules_core_action_execute()

Core patches
http://drupal.org/node/496184#comment-5787602 - db_set_active errors out if db_connect fails. Add in the ability to handle this gracefully (don't always call _db_error_page)
http://drupal.org/node/764726#comment-5787642 - (Shared taxonomy patch) hook_taxonomy_term_presave() is missing
http://drupal.org/node/905156#comment-5791724 - PHP notice in form_builder function
http://drupal.org/node/1006938#comment-4661790 - Remove PHP warnings from legacy PHP4 XML parser for new update status release history XML
http://drupal.org/node/352180#comment-2562140 - Better, multi-site friendly "www." addition/removal in .htaccess
http://drupal.org/node/939810#comment-5791876 - Notice: Undefined index: key in format_xml_elements()
http://drupal.org/node/985814#comment-5791916 - Undefined index: configurable in actions_synchronize()
http://drupal.org/node/557542#comment-4989990 - Cache module_implements()
http://drupal.org/node/1317236#comment-5146174 - Race condition in file_delete: Warning: unlink() No such file or directory in file_delete()
http://drupal.org/node/1004820#comment-5171678 - Notice: Undefined index: type in dblog_build_filter_query()
http://drupal.org/node/1345204#comment-5259212 - Optimize element_children()
http://drupal.org/node/1688282#comment-6240944 - Unknown error: Function split() is deprecated in _filter_autop()
http://drupal.org/node/521838#comment-6375266 - Clean up drupal_get_schema_versions()
http://drupal.org/node/1710656#comment-6474030 - If item is hidden in _menu_tree_check_access() skip it right away.
http://drupal.org/node/1882556#comment-6913038 - Notice: Undefined index: REMOTE_ADDR in includes/bootstrap.inc on line 2835
https://www.drupal.org/node/2292125#comment-8912499 - PHP 5.5 - preg_replace(): The /e modifier is deprecated, use preg_replace_callback instead in decode_entities() (line 349 of includes/unicode.inc)

Most of the issues I'm following that have the word notice in it
https://www.drupal.org/project/issues/search?text=notice&projects=&project_issue_followers=mikeytown2&status[0]=Open&categories[0]=1&issue_tags_op=%3D&assigned=&submitted=&issue_tags=&&order=field_issue_version&sort=asc

Query used to find the worst offenders for php issues: http://groups.drupal.org/node/170339

• Awesome - I will share this back on drupal.org, in my Forum post. It's always a pleasure learning from you, back from the time when I used your Boost module, before we switched to Varnish :) – Evan Donovan Apr 16 '15 at 15:51
• On our d6 monster site we use boost & varnish together. We call boost the L2 cache. It's been that way for 4+ years now. At its peak it did 1,300 domains competing with patch. – mikeytown2 Apr 16 '15 at 19:58
• Not to derail this thread completely, but what kind of requests could Boost cache that Varnish could not? I strip cookies from Varnish that don't affect page display, so I can cache quite a lot just through Varnish alone. – Evan Donovan Apr 17 '15 at 20:50
• We'd keep around 300gb of data for all the domains on disk for crawlers; also used if we wanted to do site maintenance as boost had every request cached on disk. D6 boost also has very good cache expiration with views & panels integration. We'd use a custom crawler to refresh the varnish cache when content was created & updated by querying the boost_cache table. Being a news site for tv stations we needed the cache to be updated in under 5 minutes for all 1300+ domains. It was a huge multisite, one web server was used just to run cron 24/7. – mikeytown2 Apr 18 '15 at 6:42
• mikeytown2: Thanks so much for sharing this list. It took a long time before I had the time to actually start moving D6 sites to PHP 5.4, but this list has been tremendously helpful. I've culled the list of patches down to the ones that are applicable to us, relate specifically to PHP 5.4 issues, and have not yet been committed to modules. I might start an answer wiki with the list if that wouldn't get closed down, as this did. – Evan Donovan Aug 19 '15 at 16:33