Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
Is it possible to obfuscate or remove environment variables from phpinfo?
If not, is the only alternative to display the phpinfo function?
Thinking about it further, someone could easily print_r($_SERVER) and get the credentials as well. What would be a solution to this?
clarification
This is in regards to Apache Environment Variables.
The Suhosin patch does this:
other than that, I am not aware of a way to cleanly hide those variables.
That said, it shouldn’t be really necessary in the first place – external visitors shouldn’t be able to run
phpinfo(), or dump arbitrary variables.