A Catalog of Security Sensitive PHP Functions

These PHP functions are common targets of various security attacks. These functions should probably not be used directly (as a security best practice), but instead be wrapped by libraries that enforce security considerations.

The purpose of this list is to highlight security vulnerabilities on a PHP function basis.

• Security Sensitive Eval Functions - These functions can allow an arbitrary string or file to be executed as PHP code.
• Security Sensitive Shell Functions - These functions allow shell commands to be run on the server.
• Security Sensitive File Functions - These functions allow files to be read written, or permissions changed.
• Security Sensitive Database Functions -
• Security Sensitive HTTP Request Functions - These functions read information from the HTTP request.
• Security Sensitive HTTP Response Functions - Output functions
• Security Sensitive Network Functions - Functions which allow remote computers to be accessed
• Security Sensitive Mail Functions - Functions which allow mail to be sent.

• See security attacks catalog.
• See security best practices.
• See Web Application Security.