<story><title>Securing PHP</title><url>http://www.jamescun.com/2011/10/securing-php/</url></story><parent_chain></parent_chain><comment><author>snorkel</author><text>What&apos;s missing from just about every PHP app and PHP framework is this bit of Apache config that prevents execution of trojan PHP scripts:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    &amp;#60;Directory /var/www/website&amp;#62;
     # Only execute /index.php and no other PHP files
     RewriteCond %{REQUEST_FILENAME} -f
     RewriteCond %{REQUEST_FILENAME} .php$
     RewriteCond %{REQUEST_URI} !=/index.php
     RewriteRule ^(.*)$ not_happening [L,F]
    &amp;#60;/Directory&amp;#62;

    # Remove other file types from PHP execution
    RemoveHandler .phtml .php3
&lt;/code&gt;&lt;/pre&gt;
This way attackers can upload whatever PHP file they want but they can&apos;t execute it though an Apache request.&lt;p&gt;What if the attacker names their trojan &quot;index.php&quot;? Doesn&apos;t matter, only top-level index.php of the site can be executed.</text></comment>
<story><title>Securing PHP</title><url>http://www.jamescun.com/2011/10/securing-php/</url></story><parent_chain></parent_chain><comment><author>Udo</author><text>I see you marked the cURL functions as &quot;dangerous&quot;, advising people to disable curl_exec and curl_multi_exec. This disables all apps that do HTTP requests (except those that communicate through the socket functions). Is there any particular reason why you consider cURL problematic?</text></comment>