In a project I’m currently working for, we’re considering putting system() into php.ini’s disable_functions declaration. Now, one meta-module of ours which would ultimately also fall victim to this restriction is syntax-checking files with system("php -l"); calls – prompting me to hunt for alternatives.
Turns out there used to be a php_check_syntax(), but not only did that not restrict itself to merely checking syntax and went on to include the file if it was syntactically valid, but it’s been removed as of PHP 5.0.5. The manual suggests php -l in its place, but given that I’m sure disabling system call functions in PHP is a fairly common practise, I’m wondering if there is an accepted, ‘better’ way of syntax checking PHP files from within PHP files.
(I’m not hell-bent on this, by the way; a ‘no’ perfectly suffices (and I expect it, really). We can excempt the module from this restriction – but I’m asking this question both out of curiosity as well as in hope of a more graceful solution.)
I found an alternative using PECL runkit_lint_file().
It does the same check as php_check_syntax().
I think it’s worth a look.