PHP MySQL - Stilson.net

CHAPTER 21 • SECURING YOUR WEB SITEwww.it-ebooks.infoConfiguring PHP SecurelyPHP offers a number of configuration parameters that are intended to greatly increase its level ofsecurity awareness. This section introduces many of the most relevant options.■ Note For years, PHP offered a security-specific option known as safe mode, which attempts to render both PHPand the web server more secure by restricting access to many of PHP’s native features and functions. However,because safe mode often creates as many problems as it resolves, largely due to the need for enterpriseapplications to use many of the features safe mode disables, the developers decided to deprecate the feature as ofPHP 5.3.0. Therefore, although you’ll find quite a few references to safe mode around the Web, you should refrainfrom using it and instead seek to implement other safeguards (many of which are introduced in this chapter).Security-Related Configuration ParametersThis section introduces several configuration parameters that play an important role in better securingyour PHP installation.disable_functions = stringScope: PHP_INI_SYSTEM; Default value: NULLYou can set disable_functions equal to a comma-delimited list of function names that you want todisable. Suppose that you want to disable just the fopen(), popen(), and file() functions. Set thisdirective like so:disable_functions = fopen,popen,filedisable_classes = stringScope: PHP_INI_SYSTEM; Default value: NULLGiven the new functionality offered by PHP’s embrace of the object-oriented paradigm, it likelywon’t be too long before you’re using large sets of class libraries. However, there may be certain classeswithin these libraries that you’d rather not make available. You can prevent the use of these classes withthe disable_classes directive. For example, you can completely disable the use of two classes, namedadministrator and janitor, like so:disable_classes = "administrator, janitor"display_errors = On | OffScope: PHP_INI_ALL; Default value: On428