Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

PHP finally removed safe_mode feature:

Safe Mode

Warning

This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 5.4.0.

The PHP safe mode is an attempt to solve the shared-server security problem. It is architecturally incorrect to try to solve this problem at the PHP level, but since the alternatives at the web server and OS levels aren't very realistic, many people, especially ISP's, use safe mode for now.

My question is:

What are possible consequences for applications that depends on Safe Mode for security?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

The main reason why safe mode should be removed is because its doesn't work. Over the years people have found many ways of bypassing PHP's safe mode.

But the lack of enforceability is only one reason reason why Zend chose to remove "safe mode". This is a quote taken from the PHP 6 minutes discussion:

As safe_mode is a name that gives the wrong signals as making PHP safe, we all agreed that we should remove this function. It can never be made totally safe as there will always be ways to circumvent safe_mode through libraries. This kind of functionality also better belongs in the web server or other security scheme. open_basedir is a feature that we will keep, and we will point users to this functionality in the error message that is thrown when we detect this setting on start-up.

share|improve this answer
    
+ for the reason that why safe mode disabled, however, Zend should provide some points for risk assessment when upgrading PHP (from safe mode to disabled safe mode). –  Akam Mar 4 '13 at 19:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.