dsaba Posted January 20, 2008 Share Posted January 20, 2008 I've made a nice script to allow me to run/test php code on a remote server. I'm thinking about making it a public tool. What are some dangerous functions/code snippets I should filter so someone cannot attack my site/server? I've already thought about these: include eval require Link to comment https://forums.phpfreaks.com/topic/86921-dangerous-php-functionscode/ Share on other sites More sharing options...
trq Posted January 20, 2008 Share Posted January 20, 2008 Your living on the edge. Any of the filesystems functions for starters, but Id'e think pretty seriously about this before going public. Link to comment https://forums.phpfreaks.com/topic/86921-dangerous-php-functionscode/#findComment-444388 Share on other sites More sharing options...
dsaba Posted January 20, 2008 Author Share Posted January 20, 2008 You're* I thought about it, I made this thread to see of any of the people here in the community could help me brainstorm a list of functions/code to filter out, not to give me their opinion on whether they think this is a good idea period. Because I'm sure the general opinion is that it's not. I know this. Why would I make a thread to hear this opinion re-iterated? I wouldn't. I didn't. Anyone else have anything else to add other than filesystem functions, one time I saw a similar thread on someone posting a php tester they made, and a couple people made some snide remarks about code that could potentially be dangerous if tested on this online tester. Any code like this I'm interested in seeing. Link to comment https://forums.phpfreaks.com/topic/86921-dangerous-php-functionscode/#findComment-444442 Share on other sites More sharing options...
Fyorl Posted January 20, 2008 Share Posted January 20, 2008 Depending on how much code you allow people to post and what environment you're running it in there could potentially be a lot of room for malicious attacks. I'd say the curl functions could also be abused quite easily. Letting people use mail() would be bad too. Those are just some off the top of my head, if I think of some more I'll post them. Link to comment https://forums.phpfreaks.com/topic/86921-dangerous-php-functionscode/#findComment-444452 Share on other sites More sharing options...
GingerRobot Posted January 20, 2008 Share Posted January 20, 2008 You're* I thought about it, I made this thread to see of any of the people here in the community could help me brainstorm a list of functions/code to filter out, not to give me their opinion on whether they think this is a good idea period. Because I'm sure the general opinion is that it's not. I know this. Why would I make a thread to hear this opinion re-iterated? I wouldn't. I didn't. Anyone else have anything else to add other than filesystem functions, one time I saw a similar thread on someone posting a php tester they made, and a couple people made some snide remarks about code that could potentially be dangerous if tested on this online tester. Any code like this I'm interested in seeing. Stunning attitute there. Last time i checked this was a forum, which, as far as im aware, involves the sharing of opinions. Since you didn't bother to state in the topic that you understood that the general opinion would be that it was a bad idea, how can you possibly expect people to know that? Correcting the minor gramatical mistake just adds to the rudeness of the reply. Link to comment https://forums.phpfreaks.com/topic/86921-dangerous-php-functionscode/#findComment-444463 Share on other sites More sharing options...
awpti Posted January 20, 2008 Share Posted January 20, 2008 Except for the fact he wasn't looking for opinions. Reading comprehension for the win. In any case, no function is inherently dangerous unless used poorly/with no validation of incoming content. The reverse of that first part of the statement is also true. It depends on how astute you are as a developer. Link to comment https://forums.phpfreaks.com/topic/86921-dangerous-php-functionscode/#findComment-444545 Share on other sites More sharing options...
Barand Posted January 20, 2008 Share Posted January 20, 2008 Except for the fact he wasn't looking for opinions. you've just given one. Link to comment https://forums.phpfreaks.com/topic/86921-dangerous-php-functionscode/#findComment-444551 Share on other sites More sharing options...
GingerRobot Posted January 20, 2008 Share Posted January 20, 2008 Hmm, i was under the impression that, since none of us are god, asking a question is in fact the same as asking an opinion. Link to comment https://forums.phpfreaks.com/topic/86921-dangerous-php-functionscode/#findComment-444579 Share on other sites More sharing options...
KrisNz Posted January 20, 2008 Share Posted January 20, 2008 This is dangerous exec($_POST['user_command']); Link to comment https://forums.phpfreaks.com/topic/86921-dangerous-php-functionscode/#findComment-444580 Share on other sites More sharing options...
Fyorl Posted January 20, 2008 Share Posted January 20, 2008 Ooh it is indeed. You'll probably want to block passthru() and system() too then. Link to comment https://forums.phpfreaks.com/topic/86921-dangerous-php-functionscode/#findComment-444589 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.