A breakdown of 16 high-risk functions in PHP

There are many functions built into php, with their help we can develop and maintain more quickly, but there are still many functions in this function that are accompanied by high risks, such as the 16 Don't use functions unless absolutely necessary, because many "experts" can exploit your vulnerabilities through these functions.

passthru()
Function description: Allows to execute an external program and echo the output, similar to exec().
Danger level: High

exec()
Function description: Allows the execution of an external program (such as UNIX Shell or CMD command, etc.).
Danger level: High

system()
Function description: Allows the execution of an external program and echoes the output, similar to passthru().
Danger level: High

chroot()
Function description: Can change the working root directory of the current PHP process, only when the system supports CLI mode
PHP works, and this function is not available on Windows systems.
Danger level: High

chgrp()
Function description: Change the user group to which a file or directory belongs.
Danger level: High

chown()
Function description: Change the owner of a file or directory.
Danger level: High

shell_exec()
Function description: Execute the command through the Shell and return the execution result as a string.
Danger level: High

proc_open()
Function description: Execute a command and open the file pointer for reading and writing.
Danger level: High

proc_get_status()
Function description: Get information about the process opened using proc_open().
Danger level: High

ini_alter()
Function description: It is an alias function of the ini_set() function and has the same function as ini_set().
See ini_set() for details.
Danger level: High

ini_set()
Function description: Can be used to modify and set PHP environment configuration parameters.
Danger level: High

ini_restore()
Function description: Can be used to restore PHP environment configuration parameters to their initial values.
Danger level: High

dl()
Function description: Load a PHP external module while PHP is running (not at startup).
Danger level: High

pfsockopen()
Function description: Establish a socket persistent connection in the Internet or UNIX domain.
Danger level: High

popen()
Function description: You can pass a command through the parameters of popen() and execute the file opened by popen() .
Danger level: High

putenv()
Function description: Used to change the system character set environment when PHP is running. In PHP versions earlier than 5.2.6, you can use this function
After modifying the system character set environment, use the sendmail command to send special parameters to execute the system SHELL command.
Danger level: High

Related course recommendations: PHP video tutorial

The above is the detailed content of A breakdown of 16 high-risk functions in PHP. For more information, please follow other related articles on the PHP Chinese website!