Some PHP dangerous functions that need to be disabled (disable_functions ). Phpinfo () function description: outputs information about the PHP environment, related modules, and WEB environment. Hazard level: passthru () function description: allows an external program to be executed and echo the output phpinfo ()
Function description: outputs information about the PHP environment, related modules, and WEB environment.
Hazard Level: Medium
Passthru ()
Function description: Allows execution of an external program and echo output, similar to exec ().
Hazard level: High
Exec ()
Function description: Allows execution of an external program (such as a UNIX Shell or CMD command ).
Hazard level: High
System ()
Function description: Allows execution of an external program and echo output, similar to passthru ().
Hazard level: High
Chroot ()
Function description: change the working root directory of the current PHP process, only when the system supports the CLI mode
PHP only works, and this function is not applicable to Windows systems.
Hazard level: High
Scandir ()
Function description: lists files and directories in a specified path.
Hazard Level: Medium
Chgrp ()
Function description: change the user group to which the file or directory belongs.
Hazard level: High
Chown ()
Function description: change the owner of a file or directory.
Hazard level: High
Shell_exec ()
Function description: execute the command through Shell and return the execution result as a string.
Hazard level: High
Proc_open ()
Function description: execute a command and open the file pointer for reading and writing.
Hazard level: High
Proc_get_status ()
Function description: gets information about the processes opened with proc_open.
Hazard level: High
Error_log ()
Function description: Sends an error message to a specified location (file ).
Security Note: in some PHP versions, error_log () can be used to bypass PHP safe mode,
Execute any command.
Hazard level: low
Ini_alter ()
Function description: it is an alias function of the ini_set () function. its function is the same as that of ini_set.
For more information, see ini_set ().
Hazard level: High
Ini_set ()
Function description: used to modify and set PHP environment configuration parameters.
Hazard level: High
Ini_restore ()
Function description: used to restore the PHP environment configuration parameters to their initial values.
Hazard level: High
Dl ()
Function description: loads a PHP external module while PHP is running (rather than starting.
Hazard level: High
Pfsockopen ()
Function description: establishes a socket persistent connection in the Internet or UNIX domain.
Hazard level: High
Syslog ()
Function description: you can call the system-layer syslog () function of a UNIX system.
Hazard Level: Medium
Readlink ()
Function description: returns the content of the target file to which the symbolic connection points.
Hazard Level: Medium
Symlink ()
Function description: creates a symbolic link in a UNIX system.
Hazard level: High
Popen ()
Function description: you can pass a command through the popen () parameter and execute the file opened by popen.
Hazard level: High
Stream_socket_server ()
Function description: establishes an Internet or UNIX server connection.
Hazard Level: Medium
Putenv ()
Function description: used to change the system character set environment when PHP is running. This function can be used in PHP versions earlier than 5.2.6.
After modifying the system character set environment, use the sendmail command to send special parameters to execute the system SHELL command.
Hazard level: High
The method to disable the service is as follows:
Open the/etc/php. ini file,
Find disable_functions and add the function name to be disabled as follows:
Phpinfo, eval, passthru, exec, system, chroot, scandir, chgrp, chown, shell_exec, proc_open, proc_get_status, ini_alter, ini_alter, digest, dl, pfsockopen, openlog, syslog, readlink, symlink, popepassthru, stream_socket_server, fsocket, fsockopen
Http://www.bkjia.com/PHPjc/325115.htmlwww.bkjia.comtruehttp://www.bkjia.com/PHPjc/325115.htmlTechArticlephpinfo () function description: output PHP environment information and related modules, WEB environment and other information. Hazard level: passthru () function description: Allows execution of an external program and echo output...