PHP needs to ban some dangerous functions_PHP tutorial

Share with friends in the PHP environment that some dangerous functions need to be banned in PHP. You can ban unused functions according to your own needs.

phpinfo()
Function description: Output PHP environment information and related module, WEB environment and other information.
Danger level: Medium

passthru()
Function description: Allows executing an external program and echoing the output, similar to exec().
Hazard level: High

exec()
Function description: Allows the execution of an external program (such as UNIX Shell or CMD command, etc.).
Hazard level: High

system()
Function description: Allows executing an external program and echoing the output, similar to passthru().
Hazard level: High

chroot()
Function description: Can change the working root directory of the current PHP process, only if the system supports CLI mode
This function only works with PHP and is not available on Windows systems.
Hazard level: High

scandir()
Function description: List files and directories in the specified path.
Danger level: Medium

chgrp()
Function description: Change the user group to which a file or directory belongs.
Hazard level: High

chown()
Function description: Change the owner of a file or directory.
Hazard level: High

shell_exec()
Function description: Execute the command through Shell and return the execution result as a string.
Hazard level: High

proc_open()
Function description: Execute a command and open the file pointer for reading and writing.
Hazard level: High

proc_get_status()
Function description: Get information about the process opened using proc_open().
Hazard level: High

error_log()
Function description: Send error information to the specified location (file).
Security Note: In some versions of PHP, error_log() can be used to bypass PHP safe mode,
Execute arbitrary commands.
Hazard Level: Low

ini_alter()
Function description: It is an alias function of the ini_set() function and has the same function as ini_set().
See ini_set() for details.
Hazard level: High

ini_set()
Function description: Can be used to modify and set PHP environment configuration parameters.
Hazard level: High

ini_restore()
Function description: Can be used to restore PHP environment configuration parameters to their initial values.
Hazard level: High

dl()
Function description: Load a PHP external module while PHP is running (not when it is started).
Hazard level: High

pfsockopen()
Function description: Establish a socket persistent connection in the Internet or UNIX domain.
Hazard level: High

syslog()
Function description: The system layer syslog() function of the UNIX system can be called.
Danger level: Medium

readlink()
Function description: Returns the contents of the target file pointed to by the symbolic link.
Danger level: Medium

symlink()
Function description: Create a symbolic link in UNIX systems.
Hazard level: High

popen()
Function description: A command can be passed through the parameters of popen() and executed on the file opened by popen().
Hazard level: High

stream_socket_server()
Function description: Establish an Internet or UNIX server connection.
Danger level: Medium

putenv()
Function description: Used to change the system character set environment when PHP is running. In PHP versions earlier than 5.2.6, this function can be used
After modifying the system character set environment, use the sendmail command to send special parameters to execute the system SHELL command.
Hazard level: High

The disabling method is as follows:
Open the /etc/php.ini file,
Find disable_functions and add the function name to be disabled, as follows:
phpinfo,eval,passthru,exec,system,chroot,scandir,chgrp,chown,shell_exec,proc_open,proc_get_status

http://www.bkjia.com/PHPjc/629670.htmlwww.bkjia.comtruehttp: //www.bkjia.com/PHPjc/629670.htmlTechArticle Share with friends in the PHP environment about the need to ban some dangerous functions in PHP. Pengjia can ban them according to their own needs. Let’s look at some unused functions. phpinfo() Function Description: Output P...