Penguicon 2006

Dangerous Functions :: Handle with care

Dangerous Functions :: Handle with care

• Control Structures
• • include -- includes and evaluates the specified file.
  • include_once
  • require
  • require_once
• Code Execution
• • eval () -- Evaluate a string as PHP code
  • preg_replace() -- The /e modifier causes backreferences to be evaluated as PHP code
• Command Execution
• • exec () -- Execute an external program
  • pcntl_exec()
  • shell_exec() - Execute command via shell
  • backtick operator
  • system()
  • passthru()
  • popen() Opens process file pointer
• File
• • fopen() -- Opens file or URL
  • readfile() - Outputs a file
  • file_get_contents() -- Reads entire file into a string
  • file() - Reads an entire file into an array
• Misc
• • extract() -- Import variables into the current symbol table from an array
  • stripslashes() -- Un-quote string quoted with addslashes()
  • urldecode() -- Decodes URL-encoded string
  • rawurldecode() -- Decode URL-encoded strings