All 7 Security questions
More in Security
Why should passwords always be hashed before storing them in a database, and how does PHP's password_hash function make this straightforward and secure? What is cross site request forgery, commonly called CSRF, and how do CSRF tokens help protect forms from this type of attack? Why is validating and sanitizing file uploads important, and what specific checks should you perform to prevent an attacker from uploading a malicious file? What is the principle of least privilege, and how should it guide decisions about database user permissions and environment configuration in a PHP application?
Advertisement
Back to results for “Security”
PHP › Security

How can PHP's built in disabled functions setting and other server level configuration hardening reduce the impact of a successful attack against an application?

Advanced

Answer

Beyond writing secure application code, hardening the PHP environment itself provides an important additional layer of defense, and this includes disabling dangerous functions that are rarely needed in a typical web application, such as exec, shell_exec, and eval, through the disable_functions setting in php.ini, turning off the display of detailed error messages in production so internal application details are never exposed to visitors, keeping PHP and all installed packages updated to receive security patches, and running the web server process with a restricted, non administrative user account.
; php.ini
disable_functions = exec,shell_exec,system,passthru,eval
display_errors = Off
log_errors = On
Real-world example A shared hosting provider disables several potentially dangerous PHP functions across all hosted applications, significantly reducing what an attacker could actually accomplish even if they somehow managed to get malicious code to execute on the server.

Common follow-ups: What is the tradeoff of disabling functions that some legitimate applications might actually need?;How does keeping detailed error messages hidden in production actually improve security?

Deployment & Hosting for PHP Applications;Error & Exception Handling
All 7 Security questions