Workarounds for cheap shared PHP hosting where half the standard library is missing. Real patterns from production servers running on All-Inkl, IONOS, Strato, Hosteurope.
If you've ever seen Call to undefined function curl_init() and want to throw your laptop out the window, this cookbook is for you.
| Extension / function | Common on cheap shared? | Workaround chapter |
|---|---|---|
curl |
❌ rarely | HTTPS without curl |
openssl_* for streams |
❌ often disabled | HTTPS without curl |
shell_exec, exec, passthru |
❌ always disabled | Replace shell calls |
session_start |
❌ sometimes | HMAC-CSRF tokens |
mbstring |
❌ often | Multibyte-safe UTF-8 |
iconv |
❌ often | Multibyte-safe UTF-8 |
filter_var |
✓ usually | — |
Zlib |
✓ usually | — |
bcmath, gmp, sodium |
❌ rarely | Crypto basics with hash_hmac |
pcntl_* |
❌ never | Cron-driven background work |
realpath |
✓ but tricky | Safe path handling |
Each recipe is a standalone Markdown file in recipes/ with:
- The problem — what you tried, what error you got
- The workaround — code that works in the absence of the extension
- Trade-offs — what you lose compared to the "proper" solution
- Real-world example — link to where this pattern is in production use
Code blocks are MIT-licensed snippets you can copy verbatim.
- 01 — HTTPS without curl (fsockopen + manual TLS handshake or stream_socket_client)
- 02 — Replacing shell_exec / exec on locked-down hosts
- 03 — Session-less CSRF protection with HMAC tokens
- 04 — Multibyte-safe UTF-8 without mbstring or iconv
- 05 — Crypto basics with hash_hmac and random_bytes
- 06 — Background work via cron when pcntl is gone
- 07 — Safe path handling and the realpath traps
- 08 — The apostrophe trap in single-quoted strings
- 09 — Rate limiting without Redis
- 10 — File-based queues without database
I run Die Netzhandwerker and several sub-brands on All-Inkl shared hosting. The platform is rock-solid for €5/month but the PHP environment is stripped down: no curl, no openssl streams, no sessions, no exec. After 200+ deploys I've collected the workarounds in this cookbook.
Most of these patterns also work on IONOS, Strato, Hosteurope, and the budget tier of pretty much any European shared hosting provider.
For full deploy automation on these constrained hosts, see shared-hosting-deploy-kit — a single-file PHP gateway that lets you push code, run snapshots, and roll back without SSH.
Got a workaround that saved you a weekend? Open a PR. New recipes follow this template:
# Recipe NN — Title
## The problem
...
## The workaround
\`\`\`php
// minimal working code
\`\`\`
## Trade-offs
- What you lose vs. the "proper" solution
## Real-world example
- Link to production use, anonymized if neededText and explanations: CC BY 4.0 — attribute me when reusing.
Code snippets in recipes/: MIT — copy and adapt freely.
Daniel Wesseling — Die Netzhandwerker, Gronau (Westfalen), Germany.