Edit Report a Bug

    .user.ini files

    Since PHP 5.3.0, PHP includes support for configuration INI files on a per-directory basis. These files are processed only by the CGI/FastCGI SAPI. This functionality obsoletes the PECL htscanner extension. If you are using Apache, use .htaccess files for the same effect.

    In addition to the main php.ini file, PHP scans for INI files in each directory, starting with the directory of the requested PHP file, and working its way up to the current document root (as set in $_SERVER['DOCUMENT_ROOT']). In case the PHP file is outside the document root, only its directory is scanned.

    Only INI settings with the modes PHP_INI_PERDIR and PHP_INI_USER will be recognized in .user.ini-style INI files.

    Two new INI directives, user_ini.filename and user_ini.cache_ttl control the use of user INI files.

    user_ini.filename sets the name of the file PHP looks for in each directory; if set to an empty string, PHP doesn't scan at all. The default is .user.ini.

    user_ini.cache_ttl controls how often user INI files are re-read. The default is 300 seconds (5 minutes).

    add a note add a note

    User Contributed Notes 7 notes

    up
    32
    philsward at gmail dot com
    11 years ago
    If you have no idea what "PHP_INI_PERDIR" or "PHP_INI_USER" are or how they relate to setting a .user.ini file, take a look at the ini.list page: http://www.php.net/manual/en/ini.list.php

    Basically, anything in the "Changeable" column labeled as PHP_INI_SYSTEM can't be set in the .user.ini file (so quit trying).  It can ONLY be set at the main php.ini level.
    up
    29
    Anteaus at thenox dot com
    10 years ago
    "If you are using Apache, use .htaccess files for the same effect."

    To clarify, this applies only to Apache module mode. If you put php directives in .htaccess on an Apache CGI/FastCGI server, this will bomb the server out with a 500 error. Thus, you unfortunately cannot create a config which caters for both types of hosting, at least not in any straightforward way.
    up
    16
    Anonymous
    5 years ago
    Since the .user.ini is read from public directories, it's contents will be served to anyone requesting it and potientially show them sensitive configuration settings.

    Add these lines to your .htaccess to block requests to it :
    <Files ".user.ini"> 
        Require all denied
    </Files>
    up
    10
    mark at manngo dot net
    2 years ago
    Trap for young players, not that I’m such a young player myself.

    The default setting for user_ini.cache_ttl is 300 seconds, which means that it refreshes every 5 minutes. If you are tweaking the settings in .user.ini, it could take up to 5 minutes before you see the results of your experimentation.

    If you don’t have access to php.ini where you can change this setting, you will have to learn to be very patient.
    up
    6
    signups at altillc dot com
    4 years ago
    For those looking for an example... .user.ini should be formatted as a simple list of [KEY]=[VALUE]\n sets.  For example, a one-line .user.ini file that serves solely to change the max allowable upload file size to 5Mb is:

    upload_max_filesize="5M"
    up
    3
    interfaSys
    13 years ago
    This article should be made clearer.
    ".htaccess-style INI files" meant to me that the ini settings had to follow the syntax used in .htaccess, but this is not the case!

    You have to use
    register_globals=on
    and not
    php_flag register_globals on

    Also, the changes can take a while to propagate to all processes if you have a long process time out.
    Restarting php-fpm can give you an answer quicker :)
    up
    -41
    info at vincentraal.nl
    6 years ago
    Be aware that PECL htscanner doesn't work (yet) on PHP7.0.

    'pecl install htscanner' throws an "zend_hash_update’ undeclared'" error.
    add a note add a note
    To Top