Home >Backend Development >PHP Tutorial >Some dangerous PHP functions that need to be disabled (disable_functions)_PHP tutorial
Some dangerous PHP functions that need to be disabled (disable_functions)_PHP tutorial
- WBOYOriginal
- 2016-07-21 15:20:371183browse
phpinfo()
Function description: Output PHP environment information and related module, WEB environment and other information.
Danger level: Medium
passthru()
Function description: Allows executing an external program and echoing the output, similar to exec().
Danger level: High
exec()
Function description: Allows the execution of an external program (such as UNIX Shell or CMD command, etc.).
Danger level: High
system()
Function description: Allows executing an external program and echoing the output, similar to passthru().
Danger level: High
chroot()
Function description: It can change the working root directory of the current PHP process. It can only work when the system supports CLI mode
PHP, and this function does not Available for Windows systems.
Danger level: High
scandir()
Function description: List files and directories in the specified path.
Danger level: Medium
chgrp()
Function description: Change the user group to which a file or directory belongs.
Danger level: High
chown()
Function description: Change the owner of a file or directory.
Danger level: High
shell_exec()
Function description: Execute the command through Shell and return the execution result as a string.
Danger level: High
proc_open()
Function description: Execute a command and open the file pointer for reading and writing.
Danger level: High
proc_get_status()
Function description: Get information about the process opened using proc_open().
Danger level: High
error_log()
Function description: Send error information to the specified location (file).
Safety Note: In some versions of PHP, error_log() can be used to bypass PHP safe mode and
execute arbitrary commands.
Danger level: low
ini_alter()
Function description: It is an alias function of the ini_set() function and has the same function as ini_set().
See ini_set() for details.
Danger level: High
ini_set()
Function description: Can be used to modify and set PHP environment configuration parameters.
Danger level: High
ini_restore()
Function description: Can be used to restore PHP environment configuration parameters to their initial values.
Danger level: High
dl()
Function description: Load a PHP external module while PHP is running (not when it starts).
Danger level: High
pfsockopen()
Function description: Establish a socket persistent connection in the Internet or UNIX domain.
Danger level: High
syslog()
Function description: The system layer syslog() function of the UNIX system can be called.
Danger level: Medium
readlink()
Function description: Returns the contents of the target file pointed to by the symbolic link.
Danger level: Medium
symlink()
Function description: Create a symbolic link in a UNIX system.
Danger level: High
popen()
Function description: A command can be passed through the parameters of popen() and executed on the file opened by popen().
Danger level: High
stream_socket_server()
Function description: Establish an Internet or UNIX server connection.
Danger level: Medium
putenv()
Function description: Used to change the system character set environment when PHP is running. In PHP versions earlier than 5.2.6, you can use this function
to modify the system character set environment, and then use the sendmail command to send special parameters to execute the system SHELL command.
Danger level: High
The disabling method is as follows:
Open the /etc/php.ini file,
find disable_functions, and add the function name to be disabled, as follows:
phpinfo, eval,passthru,exec,system,chroot,scandir,chgrp,chown,shell_exec,proc_open,proc_get_status,ini_alter,ini_alter,ini_restore,dl,pfsockopen,openlog,syslog,readlink,symlink,popepassthru,stream_socket_server,fsocket,fsockopen