note 107374 added to security.cgi-bin.attacks

Under possible attacks, there are attacks on the php file themselves. Some php viruses, (injecktor and variations) scan the visible directory tree for php and/or html files, then inject code (such as spam-ware to generate fraudulent page hits) into otherwise harmless and useful .php scripts. One way to block this is by using open_basedir to restrict the visible file system directories to directory tree(s) which do NOT contain any .php scripts. (see doc page "Description of core php.ini directives" Note under open_basedir to tighten open_basedir scope from /www/ which would contain .php scripts to /www/tmp/ which would protect any scripts in /www/ from modification.) If the php.ini is outside the open_basedir tree, than a malware php script has no way to alter the core web site files, even if it were succesfully uploaded via ftp or other mechanism. The damage done by the spam-ware may seem trivial, but as browsers and virus programs eventually recognize the spam-ware the web site becomes effectively completely blocked and un-browsable. ---- Server IP: 208.69.120.55 Probable Submitter: 99.18.231.227 ---- Manual Page -- http://www.php.net/manual/en/security.cgi-bin.attacks.php Edit -- https://master.php.net/note/edit/107374 Del: integrated -- https://master.php.net/note/delete/107374/integrated Del: useless -- https://master.php.net/note/delete/107374/useless Del: bad code -- https://master.php.net/note/delete/107374/bad+code Del: spam -- https://master.php.net/note/delete/107374/spam Del: non-english -- https://master.php.net/note/delete/107374/non-english Del: in docs -- https://master.php.net/note/delete/107374/in+docs Del: other reasons-- https://master.php.net/note/delete/107374 Reject -- https://master.php.net/note/reject/107374 Search -- https://master.php.net/manage/user-notes.php