Microsoft sqlsrv extension for php 5.5.x

Question

We are running php 5.3.27 on Windows, nts.

We just failed a PCI scan due to a session fixation vulnerability in PHP and need to regain PCI compliance.

It is a little frustrating, as we use session_regenerate_id() after login, so in my eyes (perhaps I am wrong) our application is not vulnerable even if php is.

To pass the scan we need to upgrade to php 5.5.2.

We use the sqlsrv driver extension from Microsoft, and I notice that they have not released a build for php 5.5.x

Does anyone have a production viable solution for this issue?

______update___________

I have found this http://social.msdn.microsoft.com/Forums/sqlserver/en-US/e1d37219-88a3-46b2-a421-73bfa33fe433/unofficial-php-55-drivers-x86 which is a non vendor build.

Has anyone used this build in production?

Thanks

Answer 1

The official Microsoft Drivers for PHP for SQL Server 3.1 is out on 2014-12-12 (see http://www.microsoft.com/en-ca/download/details.aspx?id=20098 ). It supports PHP 5.4.32, or PHP 5.5.16, or later, according to page.

Answer 2

There's an unofficial driver. Not sure if that will pass PCI.

http://social.msdn.microsoft.com/Forums/sqlserver/en-US/e1d37219-88a3-46b2-a421-73bfa33fe433/unofficial-php-55-drivers-x86