Help with Security

[sharma.chiragfaith]

I have created an online PHP code executor at http://web.guru99.com
Though I have checked all security aspects … do you experts see any major flaw that I need to care of?

[pritaeas]

No matter what I enter, I get: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING so I'd say it's secure enough... ;)

[cereal]

You should disable system() and similar functions. At the moment I can list root of the server. Also consider to run this into a jail root.

[cereal]

Ok, I see now it's fixed, disable also dir() function: http://www.php.net/manual/en/function.dir.php
Same goes for include, require, error_log (this gives the ability to send emails).

[TheApex]

RecursiveDirectoryIterator and include / include_once / require / require_once should be blocked too.

[cereal]

Sorry for the update, but finally I remembered the name of the library, consider to move the app to runkit:

• http://php.net/manual/en/runkit.sandbox.php

You can create a sandbox and so you can limit most of the problems.

[sharma.chiragfaith]

I want to use sandbox for my site's security. below is the link of method which i want to use http://php.net/manual/en/runkit.sandbox.php .

but when i am run the code of that page it says sandbox class not defined. so anyone can guide me through this step by step. Please help me my site has down due to hacking. i want to use for this site http://web.guru99.com/demo-editor-php/

[cereal]

You have to install this class, check the documentation: http://www.php.net/manual/en/runkit.installation.php

Also, disable base64_* because it's possible to run javascript through a decode.