Advice and answers from the Hostrare TeamKnowledge base

Troubleshoot - by Hostrare

Update On: 23 Jul 2021Important php security settings

PHP is a server-side scripting language. You can embed PHP code in your web pages onward with HTML. When your server supports a request for a page, it first provides the page to the PHP handler performance. The PHP handler outputs HTML code as-is, but if it confronts Cpanel PHP knowledgebase management, it produces them. Any HTML created by the PHP management is also output. The result is a web page with content that has been customized on the server before being sent to whoever inquired about it.
there are two lists where PHP arrangement rules can go: php.ini or Apache .htaccess ( please refer to what PHP running on your server)

How to view your PHP settings.

Generate a text file with a .php extension, receiving just this line.
Then browse that file to verify the PHP info page.
The following duties are used to prevent hacking trials and malware injection, etc., on your PHP utilization.

Disable_functions

This directive enables you to damage certain offices for safety reasons. It takes on a comma-delimited list of purpose names. disable_functions is not changed by Safe Mode. This directive must be set in php.ini

disable_functions = exec, passthru, shell_exec, system, proc_open, popen, curl_exec, curl_multi_exec, parse_ini_file, show_source

Please note other unwanted PHP purposes and disable them.
What is Safe Mode?

safe mode is a protection feature that was sketched to prevent hackers from meaning able to use PHP dialogues to complete commands at the producing system level (such as Linux shell commands).
To disable PHP secure mode on a server, edit the /usr/local/lib/php.ini file and change the following line:

safe_mode = Off

open_basedir restriction

The open_basedir function limits the areas or ways from which PHP is permitted to access files using purposes like fopen() and gzopen(). If a line is outdoor of the ways specified by open_basdir, PHP will decline to open it. You cannot use a symbolic link as a workaround, because the path that the symbolic link fixes to falls under the limitations of the open_basedir reception.
To prevent records from obtaining foreign records using PHP:

  WHM >> Security Center >> PHP open_basedir Tweak

Click the Enable PHP open_basedir Protection checkbox at the top of the menu.
Select areas you wish to exclude, disabling assurance for their records.

How does it work?

PHP admin directives for open_basedir are added to each Virtual Host in httpd.conf. These directives limit users’ access via PHP to only the following directories:

/usr/lib/php    /usr/local/lib/php

Register Globals

register_globals is an inside PHP setting that registers the $REQUEST array’s parts as variables. If you submit a value in a form, via POST or GET, the benefit of that input will automatically be obtainable via a variable in the PHP script, called after the name of the input area.
In other words, if you offered a form bearing a username text field, the expression ($username === $_POST[‘username’]) at the very beginning of the script would return true.
If it is enabled, any question string at the end of the URL http://yourdomainsomething.php?valid=true will affect the value of a variable $valid (for example) in something.php, if it exists.
If you’re using publically usable PHP code (a library for example) the names of variables are well known, and it would be possible for hackers to control their values by allowing values in the query string. They may be able to bypass authentication.
For safety reasons, it is suggested to disable register_globals
put in the one line of code on your php.ini

register_globals = off

allow_url_fopen

allow_url_fopen is particularly powerful. It prevents URLs (internet addresses) from staying used in PHP include() statements and in some other areas. A command such as an include(“http://website.com/page.php“) will not be permitted to perform. Only documents that reside within your website can be involved, and you must refer to them by their file pathnames, not by their internet URLs.
You can add a file from your site directly by defining its path and filename. Here is an example of how to switch a URL include to one that does not use a URL:
Assume your popular code looks like this:

include(‘http://yoursite.com/page.php’);

You would convert it to this:

include($_SERVER[‘DOCUMENT_ROOT’] . ‘/page.php’);

Turn off this settings.

allow_url_fopen = Off

Magic Quotes

Magic Quotes, usually speaking, is the method of avoiding special cases with a ‘\’ to allow a string to be recorded into a database. This is recognized as ‘magic’ because PHP can do this automatically for you if you have magic_quotes_gpc turned on.
More correctly if magic_quotes_gpc is turned on for the copy of PHP you are applying all Get, Post & Cookie variables (gpc, get it?) in PHP will already have unique characters like “, ‘ and \ escaped so it is safe to put them directly into an SQL query.