PHP Core Features and the Hosting Settings That Affect Them

PHP runs most of the websites on our shared servers, and most of the trouble developers hit is not the language but the gap between a laptop and a hosting account. This guide covers the core PHP features worth using today and, beside each one, the setting or limit on Domain India shared hosting that decides whether it works.

1. Choose your PHP version before you write anything

Every other decision follows from the version you run: code written for PHP 8.4 is a parse error on 8.1, and an application built for 7.4 usually stops dead on 8.x. On Domain India shared hosting you choose the version yourself, per account and usually per domain:

• cPanel — Software › MultiPHP Manager: How to change PHP versions in cPanel.
• DirectAdmin — the PHP version selector in the panel on port 2222: Change PHP version in DirectAdmin.
• Webuzo — the panel (Configuration › MultiPHP Manager) has its own PHP options.

On our cPanel shared servers PHP 5.1 through 8.5 is installed and selectable per account, measured on our servers on 20 September 2026. That range exists so a legacy site keeps running while it is migrated, not as a menu of equally good choices, and it changes as branches are released and retired. Open the selector and read the list it shows you, then choose using php.net's published support calendar rather than habit:

PHP 8.1 and everything older stopped receiving security fixes at the end of 2025. Those builds may still appear in the selector so an old site keeps running while you migrate it, but nothing new should be written against them.

2. Read and change your PHP settings

Before debugging anything, make PHP tell you what it thinks its configuration is. Save this as phpcheck.php in your web root, open it in a browser, then run it over SSH with php phpcheck.php and compare the two.

<?php
declare(strict_types=1);

printf("PHP %s running as %s%s", PHP_VERSION, PHP_SAPI, PHP_EOL);
printf("Loaded php.ini: %s%s", php_ini_loaded_file() ?: '(none)', PHP_EOL);
printf("memory_limit: %s%s", ini_get('memory_limit'), PHP_EOL);
printf("upload_max_filesize: %s%s", ini_get('upload_max_filesize'), PHP_EOL);
printf("post_max_size: %s%s", ini_get('post_max_size'), PHP_EOL);
printf("max_execution_time: %s%s", ini_get('max_execution_time'), PHP_EOL);
printf("display_errors: %s%s", ini_get('display_errors') ?: 'off', PHP_EOL);
printf("error_log: %s%s", ini_get('error_log') ?: '(server default)', PHP_EOL);

The browser output describes the build the web server runs for that domain; the SSH output describes the command-line build, often a different version with a different php.ini. That mismatch explains most "it works on the command line but not on the site" tickets.

Use the panel's editor rather than hand-editing files. On cPanel that is MultiPHP INI Editor — see How to edit php.ini in cPanel. The panel writes the directive into the right file for the build your account uses, which is what goes wrong when someone creates a stray php.ini by hand and wonders why it is ignored; php_ini_loaded_file() tells you which file is actually read. When a raised limit still has no effect, work through Resolving PHP memory allocation errors and custom php.ini configuration; uploads are covered in PHP upload filesize limit.

Not everything can be changed from code: ini_set('memory_limit', '512M') works, while ini_set('upload_max_filesize', '64M') does nothing, because PHP parsed the request body before your code ran. Directives marked PHP_INI_PERDIR or PHP_INI_SYSTEM in the manual belong in the configuration.

3. Extensions: what you have and what you can add

An extension is compiled code loaded into the engine — PDO, curl, mbstring, gd, intl, openssl, fileinfo, zip. Most "undefined function" errors are a missing extension, not a missing library. Read the answer from your account:

<?php
declare(strict_types=1);

$want = ['pdo_mysql', 'curl', 'mbstring', 'openssl', 'fileinfo', 'gd', 'intl', 'zip', 'Zend OPcache'];

foreach ($want as $extension) {
    printf("%-14s %s%s", $extension, extension_loaded($extension) ? 'loaded' : 'MISSING', PHP_EOL);
}

print_r(get_loaded_extensions());

On cPanel, each PHP version comes with a server-wide set of extensions that you can't switch on or off yourself: check what is loaded with the script above (phpinfo() is switched off on some of our servers), and if one you need is missing, open a ticket naming the extension and the PHP version. DirectAdmin lets you switch extensions on and off within the set the server provides, covered in Installing and managing PHP extensions in DirectAdmin. Compiling a new extension needs root, which means a VPS, and A comprehensive list of PHP modules explains what the common ones do.

An extension is part of the engine and must be provided by the host; a library is plain PHP you upload or install with Composer — which has its own limits here, covered in section 8.

4. Errors: loud in development, logged in production

The most useful habit in PHP is refusing to let a failure pass quietly: turn warnings into exceptions, catch everything at the top, log it.

<?php
declare(strict_types=1);

error_reporting(E_ALL);
ini_set('display_errors', PHP_SAPI === 'cli' ? '1' : '0');
ini_set('log_errors', '1');

set_error_handler(static function (int $severity, string $message, string $file, int $line): bool {
    throw new ErrorException($message, 0, $severity, $file, $line);
});

set_exception_handler(static function (Throwable $e): void {
    error_log(sprintf('[%s] %s in %s:%d', $e::class, $e->getMessage(), $e->getFile(), $e->getLine()));
    http_response_code(500);
    echo 'Something went wrong. The error has been logged.';
});

echo intdiv(1, 0);

The last line throws DivisionByZeroError, the handler catches it, and the visitor sees one plain sentence while the detail goes to the log. Catching Exception alone would miss it: TypeError, ValueError and DivisionByZeroError extend Error, not Exception, and only Throwable covers both. Pass JSON_THROW_ON_ERROR to every json_decode() for the same reason.

error_log() writes to whatever error_log points at — your phpcheck.php output says where. In cPanel the account's errors also appear under Metrics › Errors, and every panel has a log viewer: see Reviewing error logs in cPanel and DirectAdmin.

5. The language core worth using in 2026

PHP has changed more in the last five years than in the fifteen before. These core features remove whole classes of bug:

<?php
declare(strict_types=1);

enum Status: string
{
    case Active    = 'active';
    case Suspended = 'suspended';

    public function label(): string
    {
        return match ($this) {
            Status::Active    => 'Active',
            Status::Suspended => 'Suspended',
        };
    }
}

final readonly class Invoice
{
    public function __construct(
        public int $number,
        public int $totalPaise,
        public Status $status,
    ) {}
}

$invoice = new Invoice(number: 1001, totalPaise: 67850, status: Status::from('active'));
echo $invoice->status->label(), ' invoice #', $invoice->number, PHP_EOL;

$customer = null;
echo $customer?->email ?? 'no customer on file', PHP_EOL;

echo implode(' ', array_map(strtoupper(...), ['php', 'core', 'features'])), PHP_EOL;

try {
    $invoice->number = 5;
} catch (Error $e) {
    echo 'readonly refused the write: ', $e->getMessage(), PHP_EOL;
}

That needs PHP 8.2 or newer, because final readonly class arrived in 8.2. The rest is older: enums, readonly properties and the strtoupper(...) first-class callable syntax came in 8.1; match, named arguments, constructor property promotion and ?-> came in 8.0. Later branches add typed class constants and #[\Override] (8.3), property hooks and array_find() (8.4), and the pipe operator (8.5) — use those only once your selector shows you are on that branch.

Stop writing the rest. mysql_* went in PHP 7, along with each(), create_function() and magic quotes. Dynamic properties and ${var} interpolation were deprecated in 8.2, and implicitly nullable parameters — function f(string $x = null) — in 8.4, so write ?string $x = null. Deprecations become fatal errors a branch or two later, so fix them when the log first mentions them.

6. MySQL through PDO

Use PDO with real prepared statements and exceptions. This runs as it stands, on SQLite in memory, so you can watch an injection fail:

<?php
declare(strict_types=1);

$pdo = new PDO('sqlite::memory:', null, null, [
    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
]);

$pdo->exec('CREATE TABLE users (id INTEGER PRIMARY KEY, email TEXT UNIQUE, name TEXT)');
$pdo->prepare('INSERT INTO users (email, name) VALUES (?, ?)')
    ->execute(['[email protected]', "Meera D'Souza"]);

$statement = $pdo->prepare('SELECT id, name FROM users WHERE email = ?');

$statement->execute(["[email protected]' OR '1'='1"]);
var_dump($statement->fetch());          // false: hostile input matched nothing

$statement->execute(['[email protected]']);
print_r($statement->fetch());           // the real row, apostrophe intact

For MySQL on your account the connection looks like this. ATTR_EMULATE_PREPARES => false makes PDO send the statement and the values to MySQL separately instead of building the SQL string itself:

<?php
declare(strict_types=1);

$name = getenv('DB_NAME') ?: 'cpuser_appdb';

$pdo = new PDO(
    "mysql:host=localhost;dbname={$name};charset=utf8mb4",
    getenv('DB_USER') ?: 'cpuser_appuser',
    getenv('DB_PASS') ?: '',
    [
        PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
        PDO::ATTR_EMULATE_PREPARES   => false,
    ]
);

Three things are specific to shared hosting: the host is localhost; your database and database user both carry your account prefix, so a database you called appdb is really cpuser_appdb; and the credentials file belongs one level above public_html, where the web server can never serve it. Creating the database and user is covered in How to connect to the MySQL database.

7. Files, uploads and large data

Never trust what the browser says a file is: the filename and the MIME type in $_FILES both come from the client, and only the bytes are evidence.

<?php
declare(strict_types=1);

function storeUpload(array $file, string $destDir, int $maxBytes = 2000000): string
{
    if (($file['error'] ?? UPLOAD_ERR_NO_FILE) !== UPLOAD_ERR_OK || $file['size'] > $maxBytes) {
        throw new RuntimeException('Upload rejected, error code ' . (int) $file['error']);
    }

    $mime    = (new finfo(FILEINFO_MIME_TYPE))->file($file['tmp_name']);
    $allowed = ['image/jpeg' => 'jpg', 'image/png' => 'png', 'application/pdf' => 'pdf'];

    if (!isset($allowed[$mime])) {
        throw new RuntimeException("Type {$mime} is not allowed");
    }

    $name = bin2hex(random_bytes(16)) . '.' . $allowed[$mime];

    if (!move_uploaded_file($file['tmp_name'], $destDir . '/' . $name)) {
        throw new RuntimeException('Could not move the upload into place');
    }

    return $name;
}

finfo reads the real bytes, so a PHP script renamed photo.png is rejected. Store uploads outside public_html and serve them through a script, or at least stop PHP executing in the upload folder. When an upload disappears and $_FILES is empty, the cause is almost always post_max_size: PHP discarded the request body before your code ran, so there is no error code left to read.

For anything large, stream it: a generator keeps memory flat however big the file is.

<?php
declare(strict_types=1);

function lines(string $path): Generator
{
    $handle = fopen($path, 'rb');

    if ($handle === false) {
        throw new RuntimeException("Cannot open {$path}");
    }

    try {
        while (($line = fgets($handle)) !== false) {
            yield rtrim($line, "\r\n");
        }
    } finally {
        fclose($handle);
    }
}

$total = 0;

foreach (lines('/home/cpuser/exports/orders.csv') as $line) {
    $total += (int) explode(',', $line)[2];
}

printf('Total %d, peak memory %.1f MB%s', $total, memory_get_peak_usage(true) / 1048576, PHP_EOL);

file() or file_get_contents() on a large export needs more RAM than the file's own size, which is exactly how you meet Allowed memory size exhausted.

8. Mail, cron and the functions that are switched off

This is the section that surprises developers moving from a laptop or a VPS, so read it before you settle on an architecture.

Around fifty PHP functions are disabled engine-wide on our cPanel shared servers, for web requests and the command line alike — among them proc_open, popen, fsockopen, stream_socket_client, curl_multi_exec and escapeshellcmd. Our DirectAdmin shared servers disable the same process functions — exec, system, passthru, shell_exec, proc_open, popen — on every PHP version, and on most websites curl_exec and curl_multi_exec as well. It is a deliberate security boundary on a server shared by many accounts, and it cannot be lifted per account. The consequences are concrete:

• Composer is not pre-installed, but with jailed SSH (on request) you can download composer.phar and run php composer.phar install. Composer scripts shell out through proc_open, so if it stops with a proc_open message, run it again with --no-scripts. Or build vendor/ locally or in a CI job and upload it; Installing PHP libraries with Composer on cPanel hosting covers both routes.
• SMTP libraries fail on cPanel, because opening a socket to a mail server needs fsockopen or stream_socket_client. Use PHP's mail() with the envelope sender set — the exact settings are in PHP sendmail settings.
• Anything that spawns a process fails, including Laravel's scheduler, queue workers, and image or video tooling that calls a binary.

The full list is in PHP disabled functions on shared hosting — read it before you conclude your code is broken.

Scheduled work belongs in a cron job, not behind a URL: a script at https://example.in/cron.php can be triggered by anyone, as often as they like. Set it up in the panel's cron section — How to set up a cron job — naming the interpreter explicitly so the job uses the version you chose.

<?php
declare(strict_types=1);
// Cron line: /usr/local/bin/php /home/cpuser/scripts/cleanup.php --days=30 >> /home/cpuser/logs/cleanup.log 2>&1

$dir = __DIR__ . '/cache';

if (!is_dir($dir)) {
    fwrite(STDERR, "No such directory: {$dir}" . PHP_EOL);
    exit(1);
}

$days    = (int) (getopt('', ['days:'])['days'] ?? 30);
$cutoff  = time() - $days * 86400;
$removed = 0;

foreach (new DirectoryIterator($dir) as $entry) {
    if ($entry->isFile() && $entry->getMTime() < $cutoff) {
        unlink($entry->getPathname());
        $removed++;
    }
}

fwrite(STDOUT, "Removed {$removed} file(s)" . PHP_EOL);
exit(0);

Run it as often as it needs, not every minute: account resource limits apply to cron as they do to page views.

9. OPcache and the cheap performance wins

OPcache keeps the compiled form of your PHP files in memory so the engine stops recompiling the same code on every request — the largest free speed-up a PHP site can get. Check it for your own account:

<?php
declare(strict_types=1);

if (!function_exists('opcache_get_status')) {
    echo 'The OPcache extension is not loaded.', PHP_EOL;
    return;
}

$status = opcache_get_status(false);

if (!is_array($status) || empty($status['opcache_enabled'])) {
    echo 'OPcache is loaded but switched off for this SAPI.', PHP_EOL;
    return;
}

printf(
    'Cached scripts: %d, hit rate %.1f%%%s',
    $status['opcache_statistics']['num_cached_scripts'],
    $status['opcache_statistics']['opcache_hit_rate'],
    PHP_EOL
);

A low hit rate usually means the cache is too small for the number of files, or that a custom php.ini turned OPcache off; How to enable OPcache for PHP and the PHP OPcache guide cover the settings. The command-line build often has OPcache off on purpose, so the number that matters is the browser's.

After that, every win is doing less work per request: cache the slowest query or API response with a timestamp, index the columns you filter on, and set a timeout on every outbound HTTP call so one slow third party cannot hold your PHP workers. Our shared servers run Apache, so WordPress page caching should come from WP Super Cache or W3 Total Cache. See also Top PHP settings to optimize performance.

10. When shared hosting is not enough

Shared hosting is the right home for most PHP: a company site, WordPress, an application that runs inside a request and finishes. You get a panel, a PHP selector, free SSL, email, weekly backups and no server to maintain. It is the wrong home for one kind of project, and it is better to know that on day one than after a week of failed deploys.

A VPS gives you root and the whole machine: install any PHP branch, compile any extension, run Composer and Supervisor, open ports. You also take on patching and monitoring it.

The App Platform sits between the two. You push code from Git and we run the containers, the database and the SSL — no server administration, no disabled-functions list. It is the practical answer for a Laravel or Symfony application, an API or a dashboard that needs Composer and background work but not a whole server.

Prices on those cards are Domain India list prices, exclude 18% GST, and are the ones you see at checkout on the day you order.

Frequently asked questions

Ready to build? If you are starting a PHP site, pick a plan on cPanel hosting or DirectAdmin hosting and set your version in the selector on day one. If the project needs Composer scripts, workers or root, look at the App Platform or a VPS. Stuck on a setting, a limit or an error log? Open a ticket with the domain and the exact error text — live chat is open around the clock and tickets get a first response within 15 minutes.