Disable PHP Functions Using disable_functions in php.ini

Filed under:

PHP is a feature rich scripting language, but when used improperly, whether intentionally or unintentionally, it can cause damage to be done. This damage can be total compromise of the web server and/or its data. Using the php.ini file, we can easily disable PHP functions which we deem to be dangerous.

To disable particular functions, PHP allows us a directive which we can use to specify which functions we want to be disabled. As mentioned earlier, this directive is placed in the php.ini file and is applied to all scripts run by the PHP interpreter which uses that configuration file.

PHP Disable Function - Locate your php.ini file

On a Windows server, php.ini is usually found in your PHP install folder.

On Linux, you can run the following command to locate your php.ini file.

php -i | grep php.ini

The output of that command will tell you where your php.ini file can be found. Once you have the location, navigate to the file and open it with a text editor using something like notepad on Windows or from a Linux terminal:

vi /etc/php/php.ini

Take care to replace /etc/php/php.ini with the file location you just determined.

PHP Disable Function Example - Find disable_functions in the php.ini

Find the line that says:

disable_functions =

And change it to:

disable_functions = "function1, function2, ..., function(n)"

Where function1, function2, ..., function(n) are the names of the functions that you want to disable.

Which PHP Functions to Disable

The most common functions you may want to disable are shown below and would make the directive look like this:

disable_functions = "apache_child_terminate, apache_setenv, define_syslog_variables, escapeshellarg, escapeshellcmd, eval, exec, fp, fput, ftp_connect, ftp_exec, ftp_get, ftp_login, ftp_nb_fput, ftp_put, ftp_raw, ftp_rawlist, highlight_file, ini_alter, ini_get_all, ini_restore, inject_code, mysql_pconnect, openlog, passthru, php_uname, phpAds_remoteInfo, phpAds_XmlRpc, phpAds_xmlrpcDecode, phpAds_xmlrpcEncode, popen, posix_getpwuid, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid, posix_setuid, posix_uname, proc_close, proc_get_status, proc_nice, proc_open, proc_terminate, shell_exec, syslog, system, xmlrpc_entity_decode"

PHP Disable Functions - Restart the web server

Of course, for the changes to take effect, you need to restart the web server. On Linux you would do something like:

/etc/init.d/apache2 restart

This will vary depending on the type of Linux you have installed.

If all goes well, you will get a message similar to the one below when an attempt is made to call a disabled function from a PHP script:

Warning: function_name() has been disabled for security reasons in /var/www/public_html/example.*.* on line *

We hope this tutorial was helpful in making your server more secure, by assisting you to disable PHP functions which may be dangerous.