As is well known, PHP is one of the most widely used web programming languages today. It is supported by a very large number of function libraries and extension modules, …
Because PHP is extended by functions that can interact with and execute directly against the host system, those functions carry real risk — and if system administrators do not take security seriously, the consequences can be severe.
Nearly all hosting providers worldwide are compelled to disable certain PHP functions for security reasons (malware distribution, local attacks, botnets, DoS, and similar risks) — these are functions that hosting providers around the world consider extremely dangerous.
To understand the issue, why these functions are blocked and which ones must be blocked, see the descriptions in the table below:
| STT | Name | Features | Description |
| 1 | system | Execute an external program and display the output | system() behaves like the C version of the function: it executes the given command and returns the output. The system() call also attempts to flush the web server's output buffer automatically after each line of output if PHP is running as a server module. If you need to execute a command and have all data from the command passed straight back without interference, use the passthru() function. |
| 2 | exec | Run an external program | Allows an external program to be executed. Easily abused to escalate privileges and run malicious programs. |
| 3 | shell_exec | Executes a command through the shell and returns the complete output as a string | Executes a command and returns the result as a string. Like exec, it is easily abused and exploited for malicious purposes. |
| 4 | proc_close | Closes a process opened by proc_open() and returns that process's exit code | proc_close() is similar to pclose(), except that it works only on processes opened by proc_open(). proc_close() waits for the process to terminate and returns its exit code. If you have pipes open to that process, close them with fclose() before calling this function to avoid a deadlock — the child process may be unable to exit while the pipes are open. |
| 5 | proc_get_status | Get information about a process opened by Proc_open () | proc_get_status() retrieves data about a process opened with proc_open(). |
| 6 | proc_nice | Change the priority of the current process | Changes the priority of the current process. This causes a resource escalation problem. |
| 7 | popen | Open the process file handle | popen is similar to proc_open but is used less often. |
| 8 | proc_terminate | Close a process opened by Proc_open | Signals a process (created with proc_open()) to terminate. proc_terminate() returns immediately and does not wait for the process to end, allowing you to terminate the process and move on to other work. You can poll the process (to check whether it has stopped) with proc_get_status(). This makes it easy for important running processes to be interrupted by this function, which can have serious consequences and create data security problems. |
| 9 | escapeshellcmd | Escape shell metacharacters | escapeshellcmd() escapes any character in a string that could be used to trick a shell command into executing arbitrary commands. Use this function to ensure that data originating from user input is escaped before it is passed to exec(), system() or the backtick operator. The following characters are prefixed with a backslash: & # ; ` | * ? ~ < > ^ ( ) [ ] { } $ , \x0A and \xFF. Single and double quotes are escaped only when they are unpaired. On Windows, all of these characters plus % and ! are replaced with spaces. |
| 10 | escapeshellcmd | Escape a string used as a shell argument | escapeshellarg() adds single quotes around a string and quotes or escapes any existing single quotes, allowing you to pass a string directly to a shell function and have it treated as a single safe argument. Use this function to escape individual arguments to shell functions when those arguments come from user input. Shell functions include exec(), system() and the backtick operator. On Windows, escapeshellarg() replaces percent signs, exclamation marks (delayed variable substitution) and double quotes with spaces, and adds double quotes around the string. |
| 11 | dl | Load a PHP extension at runtime | Loads the PHP extension given by the library parameter. Use extension_loaded() to test whether a given extension is available. This works for both built-in extensions and those loaded dynamically (either through php.ini or dl()). |
| 12 | show_source | Returns a file with its PHP syntax highlighted. The highlighting is applied using HTML tags. | Prints or returns a syntax-highlighted version of the code in the given file, using the colors defined in PHP's built-in syntax highlighter. Many servers are configured to automatically highlight files with the .phps extension. For example, viewing example.phps will display the source of the file with syntax highlighting |
| 13 | ini_alter | This function is an alias of: ini_set() | Sets the value of the given configuration option. The option keeps this new value for the duration of the script and is restored when the script ends. |
| 14 | virtual | Perform an Apache subrequest | Perform an Apache subrequest |
| 15 | openlog | Opens a connection to the system logger for a program | Opens a connection to the system logger for a program |
| 16 | Sending mail without authentication | Sending mail without authentication | |
| 17 | symlink | Create a symbolic link | Create a symbolic link |
The table above lists the PHP functions that have been disabled (disable functions). So which PHP/Apache functions and modules are supported? The table below sets them out in detail:
| STT | Apache Module | PHP Extention |
| 1 | config | libc-client |
| 2 | config-runtime | pear |
| 3 | devel | php-bcmath |
| 4 | mod-alt-passenger | php-bz2 |
| 5 | mod_bwlimited | php-calendar |
| 6 | mod_cache | php-cli |
| 7 | mod_cgid | php-common |
| 8 | mod_charset_lite | php-curl |
| 9 | mod_deflate | php-dba |
| 10 | mod_env | php-devel |
| 11 | mod_evasive | php-enchant |
| 12 | mod_expires | php-exif |
| 13 | mod_file_cache | php-fileinfo |
| 14 | mod_headers | php-fpm |
| 15 | mod_hostinglimits | php-ftp |
| 16 | mod_http2 | php-gd |
| 17 | mod_imagemap | php-gettext |
| 18 | mod_lsapi | php-gmp |
| 19 | mod_macro | php-iconv |
| 20 | mod_mime_magic | php-imap |
| 21 | mod_mpm_event | php-intl |
| 22 | mod_proxy | php-ioncube |
| 23 | mod_proxy_fcgi | php-litespeed |
| 24 | mod_proxy_http | php-mbstring |
| 25 | mod_proxy_wstunnel | php-mcrypt |
| 26 | mod_remoteip | php-mysqlnd |
| 27 | mod_reqtimeout | php-odbc |
| 28 | mod_security2 | php-pdo |
| 29 | mod_speling | php-phalcon |
| 30 | mod_ssl | php-posix |
| 31 | mod_substitute | php-soap |
| 32 | mod_suexec | php-sockets |
| 33 | mod_unique_id | php-sourceguardian |
| 34 | mod_version | php-suhosin |
| 35 | mod_vhost_alias | php-tidy |
| 36 | Tools | php-xml |
| 37 | php-zendguard | |
| 38 | php-zip | |
| 39 | runtime |
