Geek asks and answers

How should I or should use php functions that are considered "dangerous"?

A few days ago I attended a seminar and they talked about the "dangerous" PHP functions. However, they did not say that we should use them. They are called eval(), preg_match(), exec()and much more.

Although I do not use them or do not use them often, sometimes I have to. Is it bad practice to use these features? Even if I know that where I use them, the user cannot contact him?

Edit: For preg_match () questions, check the following: preg_match () security hole

+3
source share
6 answers

, . , , , , . , , , , .

PHP

PHP

+11

, "" .

  • ,
  • sloppy ,

php "", . "" (XSS), "" ( ), (, readfile (/etc/passwd) ..

+2

. , . , 100% , eval exec, , , , , , , .

+1

- , , include(), , php exec (), ini .

php.ini

; , . -; . , , . disable_functions =

JohnP ,

+1

Well ... I do not think that preg_matchthis is something "dangerous." evaland execon the other hand, a little bad. Especially exec, which is even prohibited on hosting servers, because it adds a really HUGE HUGE security threat.

0
source

More articles:


All Articles