Where is security in PHP 5.4 by removing safe_mode

Question

I have a sticky question in my mind: safe_mode deleted in PHP 5.4, so what is security with this removal?

Does this mean that any application can execute any program?

What method is used for this purpose to prevent such violent acts?

Answer 1

This article will explain to you why safe_mode never made a single point and only gives you a false sense of security.

Answer 2

safe_mode trying to solve a security problem with the wrong tool. Because shared web hosts often host thousands of websites on a single server, safe_mode was a convienent (and completely inappropriate) method to limit the damage that could be done with PHP.

It was an illusion more than anything else. Although PHP may have been protected by safe_mode , what about other languages ​​like Python and Ruby? The correct method is to use the default permissions and Linux modules, such as suPHP , which run PHP as limited users.