16 high-risk functions in PHP

There are many functions built in PHP, which can help us develop and maintain more quickly with the help of them, but there are still many functions in this function that are accompanied by high-risk. For example, the 16 functions should not be used unless they are absolutely necessary, because many "experts" can capture your vulnerabilities through these functions.

passthru()

Function Description: Allows to execute an external program and echo the output, similar to exec().

Hazard level: High

exec()

Function Description: Allows execution of an external program (such as UNIX Shell or CMD commands, etc.).

Hazard level: High

system()

Function description: Allows to execute an external program and echo the output, similar to passthru().

Hazard level: High

chroot()

Function description: Can change the working root directory of the current PHP process only if the system supports CLI mode

Only work in PHP, and this function is not applicable to Windows systems.

Hazard level: High

chgrp()

Function description: Change the user group to which the file or directory belongs.

Hazard level: High

chown()

Function description: Change the owner of a file or directory.

Hazard level: High

shell_exec()

Function description: Execute the command through the shell and return the execution result as a string.

Hazard level: High

proc_open()

Function Description: Execute a command and open the file pointer for reading and writing.

Hazard level: High

proc_get_status()

Function description: Get information about the process opened using proc_open().

Hazard level: High

ini_alter()

Function description: It is an alias function of the ini_set() function, and the function is the same as ini_set().

For details, see ini_set().

Hazard level: High

ini_set()

Function description: Can be used to modify and set PHP environment configuration parameters.

Hazard level: High

ini_restore()

Function Description: Can be used to restore PHP environment configuration parameters to their initial values.

Hazard level: High

dl()

Function description: Load a PHP external module during PHP run (rather than at startup).

Hazard level: High

pfsockopen()

Function description: Establish a socket persistent connection to the Internet or UNIX domain.

Hazard level: High

popen()

Function description: A command can be passed through the popen() parameter and execute the file opened by popen().

Hazard level: High

putenv()

Function Description: Used to change the system character set environment while PHP is running. This function can be utilized in PHP versions below 5.2.6

After modifying the system character set environment, use the sendmail command to send special parameters to execute the system SHELL command.

Hazard level: High

The above are all the relevant knowledge points. Thank you for your support.