1、限制php高风险项目

编辑php配置文件

/usr/local/php/etc/php.ini

找到disable_functions =

添加限制条目

eval,assert,popen,passthru,escapeshellarg,esacapshellcmd,passthru,exec,system,chroot,scandir,chgrp,chown,shell_exec,proc_get_status,ini_restore,dl,pfsockopen,openlog,syslog,readlink,symlink,leak,popepassthru,stream_socket_server,proc_open,proc_close

2、访问错误提示显示开关关闭并且打开php错误日志记录

display_errors = Off

log_errors = On

3、更改日志文件位置

error_log = /usr/local/php/log/php_errors.log

4、更改错误级别

error_reporting = E_ALL & ~E_NOTICE

5、限制访问目录

open_basedir =/data/www:/tmp

也可以在虚拟主机配置文件限制访问目录

在此段 ServerAlias www.aaa.com下添加以下限制条件

php_admin_value open_basedir "/data/www:/tmp"

使用curl或浏览器访问显示结果为正确200

[root@redhat www2]# curl -x127.0.0.1:80 -I www.test.com/forum.php

HTTP/1.1 200 OK

Date: Thu, 26 May 2016 01:29:04 GMT

Server: Apache/2.2.31 (Unix) PHP/5.4.36

X-Powered-By: PHP/5.4.36

将正确目录改成错误目录/data/www2后

php_admin_value open_basedir "/data/www2:/tmp"

显示结果为错误500：

[root@redhat www2]# curl -x127.0.0.1:80 -I www.test.com/forum.php

HTTP/1.0 500 Internal Server Error

Date: Thu, 26 May 2016 01:48:31 GMT

Server: Apache/2.2.31 (Unix) PHP/5.4.36

X-Powered-By: PHP/5.4.36

Cache-Control: max-age=0

Expires: Thu, 26 May 2016 01:48:31 GMT

Connection: close

Content-Type: text/html