Question

I’ve been doing some reading on PHP security and I ran into a great question/article on SO > Exploitable PHP functions

There are a ton of interesting commands/functions that should never even be possible to run.

My question is… Does CI have any built in protection/prevention against using any of the commands/functions found on this list?

If so, please point it out for me, I cant seem to find it.

If not, would it be possible to add to or create a CI core class for preventing some or all of the possibly exploitable commands?

It might sound a lil counter intuitive, but having CI dictate best practices seems to be a big part of its design… For example, the CSRF will break your form submission process if you dont set it up right… And thats built right in, but disabled…

Thanks,
Peter

Answer 1

I think I got this answered. There seems to be a preg_replace looking for these commands on the input class @ line 763.

Please correct me if I am wrong.