Advice and answers from the Hostrare TeamKnowledge base

Troubleshoot - by Hostrare

Update On: 23 Jul 2021Important php security settings

PHP is a server-side scripting letter. You can insert PHP code in your web pages with HTML. When your server gets a question for a page, it first provides the page to the PHP handler record. The PHP handler outputs HTML code as-is, but when it encounters Cpanel PHP knowledgebase management, it produces them. Any HTML created by the PHP requirements is also output. The result is a web page with content that has been customized on the server before being sent to whoever asked it.
there are two lists where PHP arrangement commands can go: php.ini or Apache .htaccess ( please refer to what PHP running on your server)

How to view your PHP settings.

Generate a text file with a .php extension, including just this line. 

Then browse that file to check php info page.

The following functions used to prevent hacking attempt and malware injection,etc., on your php application.

Disable_functions

This directive allows you to disable certain functions for security reasons. It takes on a comma-delimited list of function names. disable_functions is not affected by Safe Mode. This directive must be set in php.ini

disable_functions = exec, passthru, shell_exec, system, proc_open, popen, curl_exec, curl_multi_exec, parse_ini_file, show_source

Please refer to other unwanted PHP functions and disable them.
What is Safe Mode?
safe mode is a security feature that was designed to prevent hackers from being able to use PHP scripts to execute commands at the operating system level (such as Linux shell commands).
To damage PHP safe mode on a server, edit the /usr/local/lib/php.ini folder and modify the next line:

safe_mode = Off

open_basedir restriction

The open_basedir purpose determines the areas or paths from which PHP is permitted to locate data using purposes like fopen() and gzopen(). If a file is outdoor of the ways described by open_basdir, PHP will reject to open it. You cannot use a typical link as a workaround, because the way that the symbolic link purposes fall under the limitations of the open_basedir capacity.
To check accounts from entering foreign data using PHP:

  WHM >> Security Center >> PHP open_basedir Tweak

Click the Enable PHP open_basedir Certainty checkbox at the top of the folder.
Select sections you wish to exclude, damaging security for their records.
Click Save.
How does it work?
PHP admin directives for open_basedir are joined to each Virtual Host in httpd.conf. These directives limit users’ way via PHP to only the next records:

/usr/lib/php    /usr/local/lib/php

Register Globals

register_globals is a regional PHP setting that records the $REQUEST array’s details as variables. If you submit a value in a report, via POST or GET, the value of that input will automatically be available via a variable in the PHP script, named after the name of the input area.
In other information, if you offered a form including a username text field, the creation ($username === $_POST[‘username’]) at the very origin of the script would reverse true.
If it is allowed, any query string at the end of the URL http://yourdomainsomething.php?valid=true will affect the value of a variable $valid (for example) in something.php, if it exists.
If you’re doing publically free PHP code (a library for example) the names of variables are well understood, and it would be probable for hackers to control their powers by assigning values in the query string. They may be ready to bypass authentication.
For safety reasons, it is recommended to damage register_globals
put in the one line of key on your php.ini

register_globals = off

allow_url_fopen

allow_url_fopen is particularly valuable. It checks URLs (internet addresses) from doing used in PHP include() records and some other areas. A command such as include(“http://website.com/page.php“) will not be permitted to execute. Simply files that reside within your website can be added, and you must refer to them by their file pathnames, not by their internet URLs.
You can add a record from your site directly by defining its path and filename. Here is an example of how to convert a URL include to one that makes not use a URL:

Assume your current code looks like this:

include(‘http://yoursite.com/page.php’);

You would convert it to this:

include($_SERVER[‘DOCUMENT_ROOT’] . ‘/page.php’);

Turn off this settings.

allow_url_fopen = Off

Magic Quotes

Magic Quotes, usually talking, is the means of avoiding special cases with a ‘\’ to allow a line to be inserted into a database. This is recognized as ‘magic’ because PHP can do this automatically for you if you have magic_quotes_gpc used on.
More particularly if magic_quotes_gpc is switched on for the copy of PHP you are doing all Get, Post & Cookie variables (gpc, get it?) in PHP will already have special characters like “, ‘ and \ escaped so it is safe to put them straight into an SQL question.