Disable some dangerous functions in php

Php disables some dangerous functions passthru ()
Function description: Allows execution of an external program and echo output, similar to exec ().
Hazard level: High

Exec ()
Function description: Allows execution of an external program (such as a UNIX Shell or CMD command ).
Hazard level: High

Assert ()
Function description: If you use the default value to call assert () during program running to determine the expression, the program will continue to execute when false occurs, similar to eval, however, eval ($ code_str) only executes $ code_str conforming to php encoding specifications. The usage of assert is more detailed.
Hazard level: High

System ()
Function description: Allows execution of an external program and echo output, similar to passthru ().
Hazard level: High

Chroot ()
Function description: it can change the working root directory of the current PHP process. it only works when the system supports CLI mode PHP, and this function is not applicable to Windows systems.
Hazard level: High

Chgrp ()
Function description: change the user group to which the file or directory belongs.
Hazard level: High

Chown ()
Function description: change the owner of a file or directory.
Hazard level: High

Shell_exec ()
Function description: execute the command through Shell and return the execution result as a string.
Hazard level: High

Proc_open ()
Function description: execute a command and open the file pointer for reading and writing.
Hazard level: High

Ini_restore ()
Function description: used to restore the PHP environment configuration parameters to their initial values.
Hazard level: High

Dl ()
Function description: loads a PHP external module while PHP is running (rather than starting.
Hazard level: High

Readlink ()
Function description: returns the content of the target file to which the symbolic connection points.
Hazard Level: Medium

Symlink ()
Function description: creates a symbolic link in a UNIX system.
Hazard level: High

Popen ()
Function description: you can pass a command through the popen () parameter and execute the file opened by popen.
Hazard level: High

Stream_socket_server ()
Function description: establishes an Internet or UNIX server connection.
Hazard Level: Medium

Pfsockopen ()
Function description: establishes a socket persistent connection in the Internet or UNIX domain.
Hazard level: High

Putenv ()
Function description: used to change the system character set environment when PHP is running. In PHP versions earlier than 5.2.6, you can use this function to modify the system character set environment and then use the sendmail command to send special parameters to execute the system SHELL command.
Hazard level: High

Modification method:
Open the/etc/php. ini file,
Find disable_functions and change it to disable_functions = passthru, exec, assert, system, chroot, chgrp, chown, shell_exec, proc_open, ini_restore, dl, readlink, symlink, popen, success, pfsockopen, putenv
Oh, eval cannot be disabled. you need to use php Suhosin.

You can add the disabled method according to your environment. In fact, curl_exec (), fopen (), file_get_contents () and so on are very dangerous. There are also some directory browsing methods, but it is used in the actual project, so it cannot be disabled.
For nginx, you can restrict some static file paths from executing php, as shown in the following figure (change the directory to your own static file directory ):

          
 
 
              
  
  
location ~ /(style|html|cache|config|js|css|image|log|images|uploads|upload|attachments|templets)/.*\.(php|php5)?$ {
              
  
  
 deny all;
              
  
  
}
          
 
 

In this way, the security will be better, and more information will be added in the future, and the work will be busy.

MORE: http://www.webyang.net/Html/web/article_125.html