Home >Backend Development >PHP Problem >What are the dangerous functions in PHP?
When compiling PHP, if there is no special need, it must be prohibited to compile and generate PHP parsing support for CLI command line mode. Can be compiled using --disable-CLI. Once PHP in CLI mode is compiled and generated, the program may be used by intruders to establish a WEB Shell backdoor process or execute arbitrary code through PHP.
1. phpinfo()
Function description: Output PHP environment information and related module, WEB environment and other information.
Danger level: Medium
2. passthru()
Function description: Allows the execution of an external program and echoes the output, similar to exec().
Danger level: High
3. exec()
Function description: Allows the execution of an external program (such as UNIX Shell or CMD command, etc.).
Danger level: High
4. system()
Function description: Allows to execute an external program and echo the output, similar to passthru().
Danger level: High
5.chroot()
Function description: It can change the working root directory of the current PHP process. It can only work when the system supports CLI mode PHP. , and this function is not applicable to Windows systems.
Danger level: High
6. scandir()
Function description: List the files and directories in the specified path.
Danger level: Medium
7. chgrp()
Function description: Change the user group to which the file or directory belongs.
Danger level: High
8. chown()
Function description: Change the owner of the file or directory.
Danger level: High
9. shell_exec()
Function description: Execute the command through the Shell and return the execution result as a string.
Danger level: High
10. proc_open()
Function description: Execute a command and open the file pointer for reading and writing.
Danger level: High
11. proc_get_status()
Function description: Get information about the process opened using proc_open().
Danger level: High
12. error_log()
Function description: Send error information to the specified location (file).
Safety Note: In some versions of PHP, error_log() can be used to bypass PHP safe mode and
execute arbitrary commands.
Danger level: low
13. ini_alter()
Function description: It is an alias function of the ini_set() function and has the same function as ini_set(). See ini_set() for details.
Danger level: High
14. ini_set()
Function description: Can be used to modify and set PHP environment configuration parameters.
Danger level: High
15. ini_restore()
Function description: Can be used to restore PHP environment configuration parameters to their initial values.
Danger level: High
16. dl()
Function description: Load a PHP external module while PHP is running (not when starting).
Danger level: High
17. pfsockopen()
Function description: Establish a socket persistent connection in the Internet or UNIX domain.
Danger level: High
18. syslog()
Function description: The system layer syslog() function of the UNIX system can be called.
Danger level: Medium
19. readlink()
Function description: Return the content of the target file pointed to by the symbolic link.
Danger level: Medium
20. symlink()
Function description: Create a symbolic link in the UNIX system.
Danger level: High
21. popen()
Function description: A command can be passed through the parameters of popen() and the file opened by popen() to execute.
Danger level: High
22. stream_socket_server()
Function description: Establish an Internet or UNIX server connection.
Danger level: Medium
23. putenv()
Function description: Used to change the system character set environment when PHP is running. In PHP versions earlier than 5, 2, and 6, you can use this function to modify the system character set environment, and then use the sendmail command to send special parameters to execute the system SHELL command.
Danger level: High
Recommended tutorial: "PHP"
The above is the detailed content of What are the dangerous functions in PHP?. For more information, please follow other related articles on the PHP Chinese website!