Question

Possible Duplicate:
PHP: How To Disable Dangerous Functions

Hi, this is my situation: I must let my clients enter PHP code, but only safe functions like string function, date function etc. So I need the danger PHP functions list to remove them by using string replace before save to PHP file. Any suggestion?

Answer 1

Forget it. Reliable function whitelisting is not possible in php. Example:

$x = 'e' . str_replace('y', 'x', 'yec');
...lots of code...
$x('format c:');

realistic options are

• disabling functions (http://php.net/manual/en/ini.core.php#ini.disable-functions)
• sandboxing (see Recommendations for sandboxing inside PHP5 or alternatives?)