Sample script:

(Note, this will never report SSL even when $SSL_PROTOCOL=SSLv3 or TLSv1)

<?php
echo $SSL_PROTOCOL;
echo "<BR>Your connection method is: ";

if ( (strpos($SSL_PROTOCOL,"SSL")) || (strpos($SSL_PROTOCOL,"TLS")) )
{
        echo "SSL!";
}
else
{
        echo "non-SSL!";
}
?>

The documentation says strpos() returns FALSE if no match.  But what about a match on the first character (index 0)?  Seems like the index returned should have been 1-based instead.

The routine is flawless when the code is rewritten thusly:

<?php
echo $SSL_PROTOCOL;
echo "<BR>Your connection method is: ";

if ( (strpos($SSL_PROTOCOL,"SL")) || (strpos($SSL_PROTOCOL,"LS")) )
{
        echo "SSL!";
}
else
{
        echo "non-SSL!";
}
?>

configuration line for PHP4 build:

Command './configure' '--with-mhash=/usr/local' '--with-mcrypt=/usr/local' '--with-mysql=/usr/local' '--enable-trans-sid' '--with-mm=/usr/local' '--enable-memory-limit' '--with-zlib' '--enable-inline-optimization' '--with-imap=/usr/local' '--with-imap-ssl' '--with-gmp' '--with-gd' '--with-cpdflib' '--with-pdflib' '--with-tiff-dir' '--with-jpeg-dir' '--with-png-dir' '--enable-track-vars' '--enable-bcmath' '--enable-calendar' '--with-db3' '--enable-ftp' '--enable-shmop' '--enable-sockets' '--enable-sysvsem' '--enable-sysvshm' '--with-apache=../apache_1.3.14' 

OpenSSL 0.9.6, mod_ssl/2.7.1