Question

In php.ini, the ‘disable_functions’ directive can be used to disable certain functions that you may consider to be not necessary or dangerous ones by putting them comma separated.

I just wanted to know, it it possible to set ‘disable_functions’ using php’s function:

ini_set

For example, is following line of code correct?

ini_set('disable_functions', 'system, etc');

Thanks

Answer 1

Considering the following portion of code :

ini_set('disable_functions', 'system');
var_dump(system('echo "glop"'));

And the output :

glop
string 'glop' (length=4)

It doesn’t seem to work 😉

And, quoting the manual about disable_functions :

This directive must be set in php.ini
For example, you cannot set this in
httpd.conf.

Which means you cannot change/set disabled functions using ini_set — which seems logical : if you could change this at runtime, anyone could enable any additional function that was disabled bu the administrator for “security reasons”, which would obviously not be quite secure…