Install PHP 8.5 and check your setup

There are five common ways to put PHP on a computer, and they differ in what matters most later: whether security fixes reach you, and which branch you get at all. Ubuntu 24.04’s own package installs PHP 8.3, for example, and the newest XAMPP bundle for Windows ships PHP 8.2.12, a branch whose security fixes end with 2026.

This lesson helps you pick an install for your computer, then checks it the way you will check every PHP setup from now on: the version and the build with php -v, the extensions with php -m, the settings file with php --ini, and finally a development php.ini that shows and logs every error.

Choose an install that keeps getting security fixes

Five ways cover most setups. Each one gives you the same PHP language, but who updates it, and to which branch, is different:

• Windows: the zip from php.net. Pick the VS17 x64 Non Thread Safe build. The download page says Non Thread Safe builds are for the command line and FastCGI, and Thread Safe builds for PHP loaded as a module into a web server. It also needs Microsoft’s Visual C++ Redistributable for Visual Studio 2015-2022. Unzip it to a folder such as C:\php, add that folder to the PATH variable without overwriting what is there, and copy php.ini-development to php.ini in the same folder.
• macOS: Homebrew. brew install php installs the current branch, 8.5, with ready-built packages for Apple silicon, and puts its php.ini in etc/php/8.5 under the Homebrew folder. Older branches have formulae of their own, such as php@8.4.
• Linux: the distribution’s packages. Check the branch before you install, with apt policy php or dnf info php. Ubuntu 24.04 LTS ships 8.3, Ubuntu 26.04 LTS ships 8.5 and Debian 13 ships 8.4, and the distribution’s security team, not php.net, decides how long they are patched.
• Containers: the official Docker image. docker run --rm php:8.5-cli php -v starts a clean PHP 8.5 without installing anything else. Tags pin the branch and even the patch release, such as 8.5.11-cli, and the image comes in cli, fpm, apache and zts variants.
• A bundled stack. Installers such as XAMPP put Apache httpd, a database and PHP on a computer in one step. Their PHP is whatever the bundle ships, and XAMPP’s own FAQ says it is not meant for production use but only for development.

Three questions about your own setup decide most of the choice. Answer them, and the table marks the ways that fit and gives the reason under each one that does not:

In short: Homebrew on macOS, the php.net zip on Windows, the distribution’s packages on Linux when they ship the branch you need, and a container whenever you must match a server exactly or keep several branches side by side. A bundle is fine for a first look, as long as you know its branch and keep it off any network you do not control.

Check the version and the extensions you installed

Whatever you installed, open a new terminal so that it sees the new PATH, and ask PHP what it is. The first command names the version and the build, the second lists loaded extensionsextension: A module that adds functions and classes to PHP, such as mbstring, intl, pdo_sqlite or sodium. php -m lists the extensions an installation has loaded., filtered here to the ones later lessons of this track rely on: PDO with its drivers, mbstring, intl and sodium:

# The commands of this session, as you would type them in a terminal; the output shows what they printed.
from session import run

run("""
php -v
php -m | grep -i -E 'pdo|mbstring|intl|sodium'
""")

$ php -v
PHP 8.5.11 (cli) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.5.11, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.11, Copyright (c), by Zend Technologies
$ php -m | grep -i -E 'pdo|mbstring|intl|sodium'
intl
mbstring
PDO
pdo_mysql
pdo_pgsql
pdo_sqlite
sodium

The first line of php -v reads PHP 8.5.11 (cli) (NTS): the version, the SAPI in brackets, and the build type. NTS is a Non Thread Safe buildNTS build: A Non Thread Safe build of PHP, the usual build for the command line and PHP-FPM. A Thread Safe (TS or ZTS) build is needed when PHP runs as a module inside a threaded web server., the one the command line and PHP-FPM use; a thread-safe build says ZTS instead. The last line says OPcache, PHP’s cache of compiled scripts, is part of this build.

php -m prints every loaded module, one per line, and the session filtered it with grep. On Windows, findstr does the same job. A script can check for itself, and the next program does: it prints the build, the settings file PHP read, four settings and whether seven extensions are loaded. Run it on your own computer after you install:

<?php

// What this PHP is, which settings file it read, and whether the extensions this track uses are loaded.
printf("PHP %s, %s SAPI, %s\n", PHP_VERSION, PHP_SAPI, PHP_ZTS ? 'thread safe (ZTS)' : 'not thread safe (NTS)');
$ini = php_ini_loaded_file();
echo 'php.ini: ', $ini === false ? 'none loaded' : $ini, "\n";

echo "Settings:\n";
printf("  display_errors   %s\n", ini_get('display_errors'));
printf("  error_reporting  %s\n", error_reporting() === E_ALL ? 'E_ALL' : error_reporting());
printf("  log_errors       %s\n", ini_get('log_errors') ? 'on' : 'off');
printf("  date.timezone    %s\n", date_default_timezone_get());

echo "Extensions:\n";
foreach (['mbstring', 'intl', 'pdo_sqlite', 'sodium', 'openssl', 'dom', 'curl'] as $extension) {
    printf("  %-11s %s\n", $extension, extension_loaded($extension) ? 'loaded' : 'MISSING');
}

PHP 8.5.11, cli SAPI, not thread safe (NTS)
php.ini: none loaded
Settings:
  display_errors   1
  error_reporting  E_ALL
  log_errors       off
  date.timezone    UTC
Extensions:
  mbstring    loaded
  intl        loaded
  pdo_sqlite  loaded
  sodium      loaded
  openssl     loaded
  dom         loaded
  curl        loaded

In the recorded run every extension is loaded. On yours, a line may say MISSING. With the Windows zip, most extensions are files in the ext folder that load only when an extension= line in php.ini names them, and the manual notes that many such lines are already there behind a semicolon, which you remove. On Debian or Ubuntu, an extension is a package of its own, such as php8.4-mbstring. Extensions that do not come with PHP are installed with PIE, PHP’s installer for extensions.

Find the settings file PHP reads

The report above printed php.ini: none loaded, because the recorded runs in this track use PHP’s built-in settings, with no php.iniphp.ini: PHP's main settings file, read when PHP starts. php --ini shows which php.ini was loaded, if any, and which extra .ini files were read from the scan folder.. php --ini shows the same thing from the terminal, and PHP 8.5 added --ini=diff, which lists every setting that differs from its built-in default:

# The commands of this session, as you would type them in a terminal; the output shows what they printed.
from session import run

run("""
php --ini
php --ini=diff
""")

$ php --ini
Configuration File (php.ini) Path: "…/php/8.5.11"
Loaded Configuration File:         (none)
Scan for additional .ini files in: "…/php/8.5.11/conf.d"
Additional .ini files parsed:      …/php/8.5.11/conf.d/php.ini
$ php --ini=diff
Non-default INI settings:
html_errors: "1" -> "0"
implicit_flush: "0" -> "1"
max_execution_time: "30" -> "0"

The four lines of php --ini answer four questions. The first is the folder where this build looks for its php.ini; … stands for the folder this PHP is installed in, and on your computer it is a full path, such as etc/php/8.5 inside the Homebrew folder. The second line says no php.ini was loaded. The third and fourth name the scan folder, conf.d, whose .ini files PHP reads after php.ini; this build has one file there, and since --ini=diff shows nothing from it, it sets nothing. The three lines that --ini=diff did print come from the command line itself: the manual lists them among the CLI’s own overrides, no HTML in error messages, output written at once and no time limit for scripts.

Each INI directiveINI directive: One PHP setting, such as display_errors or date.timezone. Each has a built-in default that php.ini, the -d option of the php command or ini_set() can change. can come from several places, and PHP checks them in a fixed order. Step through it:

When PHP reads the file matters as much as which file it reads. The manual says the command line reads php.ini on every run, while a server module reads it only once, when the web server starts. PHP-FPM is a long-running service as well, and keeps the settings it read at its start until it is restarted or reloaded. That is why an edit shows up in the terminal at once and on a website only after a restart.

A development php.ini shows every error and logs it

PHP comes with two php.ini templates. They differ mainly in who sees an error, which is what you change when you move from your own computer to a live site:

Development shows every error, keeps the arguments of each call in exception traces and runs assertions. Production hides errors from visitors, leaves deprecation notices out, drops arguments from traces, where they could hold passwords, and does not compile assertions at all. Both log errors, but neither says where: neither template sets error_log, so you set it.

For your own computer, edit the php.ini that php --ini reported, or, when it reported none, copy php.ini-development to php.ini in the folder it named. Then set two directives in it: date.timezone, the zone your dates should use, such as Asia/Kolkata or Europe/London, because the built-in default is UTC; and error_log, the full path of a log file. This shorter file holds the settings that matter most, and the session below tries it with -c, which loads a file for one run without touching your real php.ini:

; Development settings: show every problem, and log it as well.
error_reporting = E_ALL
display_errors = On
display_startup_errors = On
log_errors = On
error_log = php-errors.log
date.timezone = Asia/Kolkata

<?php

echo "Hello, $name\n";

# The commands of this session, as you would type them in a terminal; the output shows what they printed.
from session import run

run("""
php -i | grep -E '^(display_errors|log_errors|error_log|date.timezone) '
php -c dev.ini --ini
php -c dev.ini --ini=diff
php -c dev.ini warn.php
cat php-errors.log
""")

$ php -i | grep -E '^(display_errors|log_errors|error_log|date.timezone) '
display_errors => STDOUT => STDOUT
error_log => no value => no value
log_errors => Off => Off
date.timezone => UTC => UTC
$ php -c dev.ini --ini
Configuration File (php.ini) Path: "…/php/8.5.11"
Loaded Configuration File:         "dev.ini"
Scan for additional .ini files in: "…/php/8.5.11/conf.d"
Additional .ini files parsed:      …/php/8.5.11/conf.d/php.ini
$ php -c dev.ini --ini=diff
Non-default INI settings:
date.timezone: "UTC" -> "Asia/Kolkata"
error_log: (none) -> "php-errors.log"
error_reporting: (none) -> "30719"
html_errors: "1" -> "0"
implicit_flush: "0" -> "1"
log_errors: "0" -> "1"
max_execution_time: "30" -> "0"
$ php -c dev.ini warn.php
Warning: Undefined variable $name in warn.php on line 3
Hello,
$ cat php-errors.log
[…] PHP Warning:  Undefined variable $name in warn.php on line 3

php -i printed the built-in values first: errors shown, nothing logged, no log file, UTC. With -c dev.ini, the second command confirms which file was loaded, and --ini=diff lists what the file changed, beside the command line’s three overrides from before. error_reporting became 30719, the value of E_ALL since PHP 8.4. Then the warning appeared twice: on the screen, from display_errors, and in php-errors.log, from log_errors, with a time stamp that […] stands for and the word PHP in front. In a real php.ini, give error_log a full path, because a relative one depends on the folder PHP was started in.

Practise: installing and checking PHP

This practice covers choosing an install, reading php -v and php -m, finding the php.ini and a development setup. Your weakest topic comes first, and every answer shows why it is right or what it misses:

Interview questions

Key takeaways

• Choose an install by who keeps it patched and which branch it gives you: the php.net zip on Windows, Homebrew on macOS, the distribution’s packages on Linux, and a container image when the branch must match a server.
• php -v names the version, the SAPI and the build type, and php -m lists the loaded extensions; on Windows an extension loads only when an extension= line in the php.ini PHP reads names it.
• php --ini shows the php.ini that was loaded and the scan folder, and php --ini=diff shows what differs from the built-in defaults; -c, PHPRC and the compiled-in folder are checked in that order, and -d wins over every file.
• The command line reads php.ini on every run, while web servers and PHP-FPM read it when they start, so restart them after an edit.
• A development php.ini shows and logs every error and sets date.timezone and error_log; a live site uses the production template, which logs errors and shows none.