Question

How can I disable the dangerous eval function? Can that be done using ini_set function?

Also how to disable following functions? Can we disable them using ini_set function?

allow_url_fopen  
allow_url_include
exec
shell_exec
system
passthru
popen
stream_select

eval is one of the most dangerous function that bad guys can use to exploit the things. There should be a mechanism to disable that without resorting to php.ini file; but is should be done programatically.

Well, guys I am looking for an answers suggesting disabling of these dangerous lovely fellows without going to php.ini file; I mean how to disable them at runtime or programatically?

Thanks in advance….

Update

Has anyone heard about PHP Shell Offender Script? It mainly used the eval function for the exploit. Hackers are able to run their PHP code on your site.

My question was that I don’t want to disable the eval function from php.ini file altogether. For example, i have developed my own MVC framework. Now the framework users can specify from frameworks config file whether eval (and others) function should be disabled or not. So this is left to the choice of framework users. Once they specify to disable it; i should be able to disable the eval function programatically.

So that is the scenario. Looking for helpful answers/solutions.

Thanks Again.

Answer 1

To disable functions, mainly for security reasons, you can use the disable_functions directive in your php.ini configuration file.

But, as the documentation states :

This directive must be set in php.ini
For example, you cannot set this in
httpd.conf.

I suppose this is too “internal” to be configurable anywhere else than in PHP… And as it’s security related, it’s up to the system administrator to configure it.

Still, the best security measure is to write clean/secure code, filter all input, escape all output… And not let anyone run their own code on your server !