How to deny the use of dangerous PHP functions?

Question

Possible Duplicate:
PHP: How To Disable Dangerous Functions

Hi, this is my situation: I must let my clients enter PHP code, but only safe functions like string function, date function etc. So I need the danger PHP functions list to remove them by using string replace before save to PHP file. Any suggestion?

Answer 1

Forget it. Reliable function whitelisting is not possible in php. Example:

$x = 'e' . str_replace('y', 'x', 'yec');
...lots of code...
$x('format c:');

realistic options are

• disabling functions (http://php.net/manual/en/ini.core.php#ini.disable-functions)
• sandboxing (see http://stackoverflow.com/questions/241168/recommendations-for-sandboxing-inside-php5-or-alternatives)

Answer 2

Giving users the possibility to enter PHP code is really dangerous. Consider all other options before implementing this. Some kind of PHP-code builder. Inspired on a Query builder.

If you decide to allow PHP code by the clients, it is better to use a whitelist. You should use regular expressions to extract these functions from the posted code.

Answer 3

What you are expected to do is extremely hard work if you want to get it right. I would start by parsing the entered php code, checking each called function, disallowing backticks altogether, etc.

In other words: If you want to allow a sub-set of PHP you must implement your own lexer (even if PHP provides you a parser out of the box).

Answer 4

The most secure and easy to maintain option will be to program a dedicated "mini-language" in php. You can make it a subset of php, or make it look like Excel formulas, or even invent your own one. This way you'll always have the full control of what's happening.

//

just for fun, here's a small Lisp for you

function lisp($x) {

    if(is_string($x)) {
        $re = '~\(([^()]*)\)~';
        while(preg_match($re, $x))
            $x = preg_replace_callback($re, 'lisp', $x);
        return trim($x);
    }

    $x = preg_split('~\s+~', $x[1]);
    $e = array_shift($x);
    if(!$x)
        return is_numeric($e) ?  floatval($e) : $e;

    switch($e) {
        case '+':  return lisp($x[0]) + lisp($x[1]);
        case '-':  return lisp($x[0]) - lisp($x[1]);
        case '*':  return lisp($x[0]) * lisp($x[1]);
        case '/':  return lisp($x[0]) / lisp($x[1]);

        case 'concat':  return lisp($x[0]) . lisp($x[1]);
    }

    return function_exists($e) ?
        call_user_func_array($e, array_map('lisp', $x)) : '';
}

$input = '
    (strtolower 
        (concat
            (strrev olleh) 
            (+ 22 20)))';

echo lisp($input); // hello42

;))