Disabling functions using the PHP disable_functions directive

The disable_functions directive in PHP allows you to block specific functions from being executed. This is often used to improve security by preventing scripts from calling potentially dangerous functions.

???? Why Disable Functions?

• Prevent execution of system commands (exec, shell_exec, system).

• Block file operations that could expose sensitive data (fopen, readfile).

• Restrict network functions (fsockopen, curl_exec) to avoid misuse.

• Harden shared hosting environments against malicious scripts.

How to Use disable_functions

Step 1: Locate or Create a php.ini File

• On ruachost.com shared hosting, you can create a custom php.ini file in your application directory.

• On VPS/Dedicated servers, edit the global php.ini file.

Step 2: Add the Directive

In your php.ini file, add:

disable_functions = exec,passthru,shell_exec,system,proc_open,popen

• Separate functions with commas.

• No spaces between function names.

Step 3: Apply Changes

• For shared hosting, changes apply immediately in the directory where php.ini is placed.

Verifying Disabled Functions

1. Create a test script:

   <?php
   echo ini_get('disable_functions');
   ?>
   

2. Load it in your browser.

3. Confirm the listed functions are disabled.

Best Practices

• Disable only functions you know are unnecessary for your application.

• Keep a backup of your original php.ini file.

• Combine with other security measures (e.g., open_basedir, disable_classes).