Disable Dangerous PHP Functions to Improve Security

Did you know that some Dangerous PHP functions can turn your website into a hacker’s playground? Functions like eval(), exec(), and unserialize() might seem handy, but they can open massive security holes if used carelessly.

Imagine a malicious user slipping in harmful code, your site could be hijacked, data stolen, or worse. Scary, right?

Before you copy-paste that “quick fix” let’s break down why these functions are risky and what safer alternatives you should use instead.

Stay sharp your code’s security depends on it! 

Why Disable Dangerous PHP Functions?

Certain PHP functions can be risky if used incorrectly. These functions come to life when an action is performed. Whether executing a system command, changing a file, or obtaining sensitive information, all of these become a real threat. Having gained access to the PHP application, an attacker can exploit these functions to:

• Execute arbitrary system commands (exec, system, passthru, etc.).
• Modify or delete files (unlink, fopen, fwrite, etc.).
• Access sensitive server information (phpinfo, getenv, etc.).
• Create or manipulate processes (proc_open, popen, etc.).

By disabling these functions, you can reduce the attack surface and minimize the risk of a security breach.

Common Dangerous PHP Functions

Here’s a list of dangerous PHP functions that are often considered Harmful and should be disabled in a production environment:

1. Execution Functions:
   • exec – Execute an external program.
   • system – Execute an external program and display the output.
   • passthru – Execute an external program and display raw output.
   • shell_exec – Execute commands via the shell.
   • popen – Open a process file pointer.
   • proc_open – Execute a command and open file pointers for input/output.
2. File System Functions:
   • unlink – Delete a file.
   • rmdir – Remove a directory.
   • fopen – Open a file or URL.
   • fwrite – Write to a file.
   • chmod – Change file permissions.
   • chown – Change file ownership.
3. Information Disclosure Functions:
   • phpinfo – Outputs information about PHP’s configuration.
   • getenv – Get the value of an environment variable.
4. Miscellaneous Functions:
   • eval – Evaluate a string as PHP code.
   • assert – Evaluate a string as PHP code (similar to eval).
   • create_function – Create an anonymous function (deprecated in PHP 7.2).

How to Disable Dangerous PHP Functions

To disable dangerous PHP functions, you can use the disable_functions directive in your php.ini file. This directive allows you to specify a comma-separated list of functions that should be disabled.

Step 1: Locate the php.ini File

The php.ini file is the configuration file for PHP. Its location depends on your server setup. Common locations include:

• /etc/php/8.x/apache2/php.ini (Linux, Apache)
• /usr/local/etc/php/8.x/php.ini (macOS, Homebrew)
• C:\xampp\php\php.ini (Windows, XAMPP)

You can also find the path to your php.ini file by running the following PHP command:

<?php phpinfo(); ?>

Look for the “Loaded Configuration File” entry in the output.

Step 2: Edit the php.ini File

Open the php.ini file in a text editor and locate the disable_functions directive. If it doesn’t exist, you can add it under the [PHP] section.

disable_functions = exec,system,passthru,shell_exec,popen,proc_open,unlink,rmdir,fopen,fwrite,chmod,chown,phpinfo,getenv,eval,assert,create_function

Step 3: Save and Restart Your Web Server

After editing the php.ini file, save the changes and restart your web server to apply the new configuration.

• For Apache:

sudo systemctl restart apache2

• For Nginx:

sudo systemctl restart nginx

Step 4: Verify the Changes

To ensure the functions have been disabled, create a PHP file with the following content and access it via your browser:

<?php
echo ini_get('disable_functions');
?>

This will display a list of disabled functions.

Additional Security Measures

While disabling dangerous PHP functions is a crucial step, it’s not the only measure you should take to secure your PHP environment. Consider the following additional steps:

1. Keep PHP Updated: Always use the latest stable version of PHP to benefit from security patches and improvements.
2. Use Secure Coding Practices: Validate and sanitize user inputs, avoid using eval, and follow best practices for secure coding.
3. Limit File Permissions: Restrict file and directory permissions to minimize the risk of unauthorized access.
4. Use a Web Application Firewall (WAF): A WAF can help detect and block malicious requests before they reach your application.
5. Regularly Audit Your Code: Perform code reviews and security audits to identify and fix vulnerabilities.

Disabling dangerous PHP functions is therefore a straightforward yet efficient way to enhance the security level of the PHP applications. By so doing, one can limit the overall capability of exploiting the PHP applications and in turn protect his or her server from potential attacks. This, in addition to other security best practices, can create a perfect environment for a web application, making it hard to exploit. Remember that security is an ongoing process: Stay awake, regularly update your software, and conduct an audit of your security practices and their effectiveness to stay one step ahead of the potential threats.