NES for PHP 7 on Windows

NES for PHP 7 for Windows is PHP 7.4.33 with HeroDevs security fixes, as a zip you unpack and run: a drop-in replacement for the PHP 7.4 zip you use today. The current release is v7.4.33-nes-7.4.4.

Supported Platforms

The zip is the thread-safe (TS) build. It runs PHP from the command line, from IIS through FastCGI and from Apache. Extensions built for PHP 7.4 thread-safe x64 (VC15), such as PECL extensions, load in it as they do in any other PHP 7.4 build of that kind.

Access

NES for PHP 7 is distributed through the NES registry at registry.nes.herodevs.com and requires an access token. If you do not have one, contact support@herodevs.com. For more information, see Access Tokens.

The zip is at https://registry.nes.herodevs.com/bin/nes/php/v7.4.33-nes-7.4.4/php-v7.4.33-nes-7.4.4.windows.x64.ts.zip. Authenticate with your contact e-mail and your access token.

Prerequisites

Install Microsoft's Visual C++ Redistributable for Visual Studio 2015-2026 (x64), version 14.51.36247 or later. The zip does not include it. Download it from Microsoft, then check the version:

(Get-Item "$env:windir\System32\vcruntime140_1.dll").VersionInfo.FileVersion

To verify the download, install Gpg4win, which provides gpg.

Download and verify

In an empty directory, download the signing key, the checksums and the zip:

$base = "https://registry.nes.herodevs.com/bin/nes/php/v7.4.33-nes-7.4.4"
$auth = "<your-contact-email>:<your-nes-access-token>"
foreach ($f in "RPM-GPG-KEY-php-nes", "SHASUMS256.txt", "SHASUMS256.txt.asc", "php-v7.4.33-nes-7.4.4.windows.x64.ts.zip") {
  curl.exe -fSLO -u $auth "$base/$f"
}

Then verify the downloads. gpg --verify must report a good signature, and the last command must print True:

gpg --show-keys .\RPM-GPG-KEY-php-nes    # must show CA44E935A3995EB733AF292B18DD1E9212F3C6A2
gpg --import .\RPM-GPG-KEY-php-nes
gpg --verify .\SHASUMS256.txt.asc .\SHASUMS256.txt
$expected = (Select-String -Path .\SHASUMS256.txt -SimpleMatch "php-v7.4.33-nes-7.4.4.windows.x64.ts.zip").Line.Split(" ")[0]
(Get-FileHash -Algorithm SHA256 .\php-v7.4.33-nes-7.4.4.windows.x64.ts.zip).Hash -eq $expected

The programs in the zip are not Authenticode-signed: the signed checksums are how you check the download.

Install

Unpack the zip to C:\php and add that folder to the system Path:

Expand-Archive -LiteralPath .\php-v7.4.33-nes-7.4.4.windows.x64.ts.zip -DestinationPath C:\php
[Environment]::SetEnvironmentVariable("Path", [Environment]::GetEnvironmentVariable("Path", "Machine") + ";C:\php", "Machine")

Open a new PowerShell window and check the installation:

php -v

It shows PHP 7.4.33-nes, built thread-safe (ZTS) for x64:

PHP 7.4.33-nes (cli) (built: <date> <time>) ( ZTS Visual C++ 2017 x64 )

Configure

PHP reads the php.ini in its own folder. Start from the production settings:

Copy-Item C:\php\php.ini-production C:\php\php.ini

In php.ini, remove the ; from the extension_dir = "ext" line and set it to "C:\php\ext". Enable each extension you use by removing the ; from its extension= line, for example extension=curl, extension=mbstring and extension=openssl. Then check what loads:

php --ini
php -m

IIS

IIS runs PHP through FastCGI. Install the CGI feature (Install-WindowsFeature Web-CGI), then in IIS Manager open Handler Mappings and add a module mapping:

and set these in php.ini:

fastcgi.impersonate = 1
cgi.fix_pathinfo = 1
cgi.force_redirect = 0

Apache

For a 64-bit Apache 2.4, add these lines to httpd.conf and restart Apache:

LoadModule php7_module "C:/php/php7apache2_4.dll"
PHPIniDir "C:/php"
AddType application/x-httpd-php .php

Move from another PHP 7.4 zip

To switch from another PHP 7.4 zip, replace its folder as described under Upgrade. These differ:

• The extension build is the same (API20190902,TS,VC15), so the extension DLLs you load today keep loading.
• OpenSSL is 3.5.9, where the zip you use now has OpenSSL 1.1.1. The legacy provider is in extras\ssl.
• The enchant extension uses Enchant 2.

Upgrade

Download and verify the new release's zip as above. Stop the web server or application that uses PHP, then replace the folder and keep your php.ini:

Rename-Item C:\php C:\php-old
Expand-Archive -LiteralPath .\php-<release>.windows.x64.ts.zip -DestinationPath C:\php
Copy-Item C:\php-old\php.ini C:\php\php.ini
php -v

Start the web server or application again. Compare your php.ini with the new php.ini-production for settings the release adds, then remove C:\php-old.

Uninstall

Stop the web server or application that uses PHP, remove the C:\php folder and remove C:\php from the system Path.