Disable dangerous PHP functions on your web hosting server

Not dangerous by design, some PHP functions can be used for malicious purposes. Many web hosting providers choose to disable such functions.

apache_child_terminate
apache_get_modules
apache_note
apache_setenv
define_syslog_variables
disk_free_space
disk_total_space
diskfreespace
dl
escapeshellarg
escapeshellcmd
exec
extract
get_cfg_var
get_current_user
getcwd
getenv
getlastmo
getmygid
getmyinode
getmypid
getmyuid
ini_restore
ini_set
passthru
pcntl_alarm
pcntl_exec
pcntl_fork
pcntl_get_last_error
pcntl_getpriority
pcntl_setpriority
pcntl_signal
pcntl_signal_dispatch
pcntl_sigprocmask
pcntl_sigtimedwait
pcntl_sigwaitinfo
pcntl_strerrorp
pcntl_wait
pcntl_waitpid
pcntl_wexitstatus
pcntl_wifexited
pcntl_wifsignaled
pcntl_wifstopped
pcntl_wstopsig
pcntl_wtermsig
php_uname
phpinfo
popen
posix_getlogin
posix_getpwuid
posix_kill
posix_mkfifo
posix_setpgid
posix_setsid
posix_setuid
posix_ttyname
posix_uname
posixc
proc_close
proc_get_status
proc_nice
proc_open
proc_terminate
ps_aux
putenv
readlink
runkit_function_rename
shell_exec
show_source
symlink
syslog
system

To add the PHP functions to the PHP configuration using WHM:

  1. Log in to WHM/cPanel
  2. Go to Home->Software->MultiPHP INI Editor.
  3. Choose the Editor Mode tab.
  4. From the drop-down list choose the PHP version.
  5. In the configuration window that will be opened, search for “disable_functions”.
; This directive allows you to disable certain functions for security reasons.
; It receives a comma-delimited list of function names. This directive is
; *NOT* affected by whether Safe Mode is turned On or Off.
; http://php.net/disable-functions
disable_functions =

Add the above functions as:

; This directive allows you to disable certain functions for security reasons.
; It receives a comma-delimited list of function names. This directive is
; *NOT* affected by whether Safe Mode is turned On or Off.
; http://php.net/disable-functions
disable_functions ="apache_child_terminate,apache_get_modules,apache_note,apache_setenv,define_syslog_variables,disk_free_space,disk_total_space,diskfreespace,dl,escapeshellarg,escapeshellcmd,exec,extract,get_cfg_var,get_current_user,getcwd,getenv,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,ini_set,passthru,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_get_last_error,pcntl_getpriority,pcntl_setpriority,pcntl_signal,pcntl_signal_dispatch,pcntl_sigprocmask,pcntl_sigtimedwait,pcntl_sigwaitinfo,pcntl_strerrorp,pcntl_wait,pcntl_waitpid,pcntl_wexitstatus,pcntl_wifexited,pcntl_wifsignaled,pcntl_wifstopped,pcntl_wstopsig,pcntl_wtermsig,php_uname,phpinfo,popen,posix_getlogin,posix_getpwuid,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,posixc,proc_close,proc_get_status,proc_nice,proc_open,proc_terminate,ps_aux,putenv,readlink,runkit_function_rename,shell_exec,show_source,symlink,syslog,system"

Click the Save button.

  • disable php function
  • 0 Users Found This Useful
Was this answer helpful?

Related Articles

How to edit PHP.INI file in your hosting?

The php.ini file is the configuration file for running applications that require PHP. You can use...

How to solve PHP file downloading issue?

This problem is mostly happend when there is some mis configuration and no any .PHP handler is...

How to change the PHP version of your domain in cPanel?

It’s always a good idea to use the latest version of PHP. For some time 2-3 PHP versions will be...