Table of Contents
A Catalog of Security Sensitive PHP Functions
These PHP functions are common targets of various security attacks. These functions should probably not be used directly (as a security best practice), but instead be wrapped by libraries that enforce security considerations.
The purpose of this list is to highlight security vulnerabilities on a PHP function basis.
Catalog
- Security Sensitive Eval Functions - These functions can allow an arbitrary string or file to be executed as PHP code.
- Security Sensitive Shell Functions - These functions allow shell commands to be run on the server.
- Security Sensitive File Functions - These functions allow files to be read written, or permissions changed.
- Security Sensitive HTTP Request Functions - These functions read information from the HTTP request.
- Security Sensitive HTTP Response Functions - Output functions
- Security Sensitive Network Functions - Functions which allow remote computers to be accessed
- Security Sensitive Mail Functions - Functions which allow mail to be sent.