What are the dangerous functions in php

Dangerous functions in php include passthru() function, exec() function, system() function, chroot() function, chgrp() function, chown() function, shell_exec() function, proc_open() function , proc_get_status() function, ini_alter() function, ini_set() function, ini_restore() function, dl() function, pfsockopen() function, etc.

The operating environment of this tutorial: Windows 10 system, PHP8.1.3 version, Dell G3 computer.

There are many functions built into php, with their help we can develop and maintain more quickly, but there are still many functions in this function that are associated with high risks, for example Do not use the 16 functions unless absolutely necessary, because many "experts" can exploit your vulnerabilities through these functions.

1. passthru() function

Function description: Allows to execute an external program and echo the output, similar to exec().

Danger level: High

2. exec() function

Function description: Allows the execution of an external program (such as UNIX Shell or CMD command, etc.).

Danger level: High

3. system() function

Function description: Allows the execution of an external program and echoes the output, similar to passthru().

Danger level: High

4. chroot() function

Function description: Can change the working root directory of the current PHP process, only if the system supports CLI mode

It can only work when using PHP, and this function is not applicable to Windows systems.

Danger level: High

5. chgrp() function

Function description: Change the user group to which a file or directory belongs.

Danger level: High

6. chown() function

Function description: Change the owner of a file or directory.

Danger level: High

7. shell_exec() function

Function description: Execute the command through the Shell and return the execution result as a string.

Danger level: High

8. proc_open() function

Function description: Execute a command and open the file pointer for reading and writing.

Danger level: High

9. proc_get_status() function

Function description: Get information about the process opened using proc_open().

Danger level: High

10. ini_alter() function

Function description: It is an alias function of the ini_set() function and has the same function as ini_set().

See ini_set() for details.

Danger level: High

11. ini_set() function

Function description: Can be used to modify and set PHP environment configuration parameters.

Danger level: High

12. ini_restore() function

Function description: Can be used to restore PHP environment configuration parameters to their initial values.

Danger level: High

13. dl() function

Function description: Load a PHP external module while PHP is running (not when starting).

Danger level: High

14. pfsockopen() function

Function description: Establish a socket persistent connection in the Internet or UNIX domain.

Danger level: High

15. popen() function

Function description: A command can be passed through the parameters of popen(), and the popen() opened file to execute.

Danger level: High

16. putenv() function

Function description: Used to change the system character set environment when PHP is running. In PHP versions earlier than 5.2.6, you can use this function

to modify the system character set environment, and then use the sendmail command to send special parameters to execute the system SHELL command.

Danger Level: High

The above is the detailed content of What are the dangerous functions in php. For more information, please follow other related articles on the PHP Chinese website!