Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suhosin can be used to increase the security of your PHP application. I can really see the use of it when you are using shared hosts, with multiple (possibly evil) people running their PHP apps there.

When you are only having one web app, your own, is there any advantage in using Suhosin?

share|improve this question
up vote 8 down vote accepted

As of 2012, Arch Linux and Debian seem to have dumped Suhosin. I would say, it's less necessary and the following blog posts cite very good reasons for not using it (mostly related to upstream compatibility and unpredictable/unreliable release cycles):

share|improve this answer
These are more arguments for why packaging Suhosin isn't worth the effort, not why you shouldn't use it if the package is available. – Brendan Long Nov 14 '12 at 22:08

I would recommend to use Suhosin. If you "trust" your code, you can't trust PHP, though. There are a lot of vulnerabilities found in past in interpreter itself and it is believed that they won't so simply disappear one day. Suhosin protects you from more "low-level" vulnerabilities like buffer overflows and etc.

share|improve this answer
Suhosin has many features which can be configured and individually disabled. For example, if on a dedicated server and your application already does session validation it should be safe to disable suhosin.session.encrypt. If you use it in production make sure to use it in development as well since some of it's features could cause unwanted side-effects and they can be very hard to track down. So at the very least you should read the suhosin feature list. – ColinM Mar 21 '12 at 19:54
"trusting" your code, that right there is a vulnerability. – rook Nov 14 '12 at 20:25

Personally I always run Suhosin on all my servers.

My main reasons are

  • Adds sha256() functionality to PHP.
  • Does some really good stuff in regards to filtering uploads done via PHP.
  • Disables some of the nasty PHP functions like eval(). Which is good as although you may very well not use it you can never tell what developers will get up to.
  • Also every other reason listed here is a good enough reason to run it.

Looking at the benchmark results for Suhosin the performance loss is insignificant at least to me.

share|improve this answer

Suhosin also adds the blowfish password hashing algorithm to platforms that do not natively support it (I think only BSD has it natively). It is far superior to MD5 and more standardized than the SHA based ones. It is also scalable, you use a configuration parameter as part of the salt to logarithmically scale the complexity of the hash, the default is 4 or 7, in a range of 0-31. A setting of 13 takes about 60 seconds per hash on a core2duo 2.4ghz.

share|improve this answer
CRYPT_BLOWFISH was added to PHP 5.3.0 (whether or not there's a system implementation). – Brendan Long Nov 14 '12 at 22:07

If you are using PHP only for your own server and only for your own scripts and applications, then you can judge for yourself, if you trust your code enough.

share|improve this answer
What does "trust your code enough" means in this context? What kind of parts are important related to this? – Peter Smit Nov 11 '10 at 22:12
If when coding, you make sure that you can trust your code to not have any security flaws itself (SQL injection etc), then you don't really need it. – James T Nov 11 '10 at 22:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.