Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

New server setup and the server admin decided phpinfo was too scary. I guess the fear is that a hacker could somehow get phpinfo() to run from injected php and find out all the extensions that are installed, their versions, etc. But, as a developer, it's nice to know all the extensions and their versions, etc. Is phpinfo a real threat? Or is this just an overzealous precaution?

share|improve this question
You're on an IT Security site. The question should be: Is there a really good reason to leave phpinfo() on? – Iszi Mar 6 '12 at 21:57

In the past there have been exploitations which utilise the phpinfo() page, using some server globals it var_dump()'s when outputting variable info.

This information merely adds to what webtoe has to say, but it's yet another attack surface you should be weary of when you consider if your users really need phpinfo() access.


share|improve this answer
It's also trivial to inject javascript into the output and therefore XSS attacks. – symcbean Mar 7 '12 at 12:43

Typically this is done as System Administrators do not appreciate telling the whole world the versions of software that they are running. Security through obscurity isn't a valid means of protecting servers but, conversely, there's no point in telling the "bad guys" which buggy version of a piece of software you're running. They need to work for their exploits.

For authorized users, the info from phpinfo should be easily attainable from other sources.

share|improve this answer

It's security through obscurity.

Security through obscurity is by no means a main defense to secure your systems. Because your system has less info to show, you are a less interesting target to attackers. This doesn't mean they won't try, but they will need to try a lot harder.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.