AlphaPatrol

POSIX Regular Expressions in PHP

Administrator — Mon, 20 Oct 2008 12:20:46 +0000

Regular expression is the basic functionality of pattern comparison. PHP offers two sets of functions for regular expressions - POSIX style and Perl style. Both types have their unique syntax and this post should give basic overview of the POSIX one.

Regular expression (called regex) is nothing more just sequence of characters (called pattern) which is compared agains a text in which we search. Patterns contain a combination of metacharacters and literals. Metacharacters (also called operators) define how literals (also called constants) should be treated on pattern evaluation against evaluated expression. For example, POSIX pattern [a-z0-9] which determines valid expression containig lowercase letters or number 0-9 has two metacharacters (opening square bracket and closing square bracket) and two literal ranges (a-z and 0-9, also called classes). In other words, literal means character itself whilst metacharacter means control character. Why it’s so important to distinguish between metacharacters and literals? The reason is that if you need to use metacharacters in pattern as a literal you must precede it by \ (backslash), very often said: it must be escaped. For example, if you need to add a dot in the regular expression pattern and don’t want to use this dot as a control character with meaning “any character” it is necessary to escape it - use it with backslash (see the table below for an example).

Following table lists POSIX metacharacters:

Metacharacter	Description	Example
^	matches the starting position within the string	^(([A-Za-z0-9_-]+)…
.	matches any one character	a.c matches “abc”
*	matches the preceding element zero or more times	abc matches “ac”, “abc”, “abbbc” [xyz] matches “”, “x”, “y”, “z”, “zx”, “zyx”, “xyzzy”
+	matches the preceding element one or more times	ba+ matches “ba”, “baa”, “baaa”
?	matches the preceding element zero or one time	ba? matches “b” or “ba”
{m,n}	matches the preceding element at least m and not more than n times	{3,5} matches only “aaa”, “aaaa”, and “aaaaa”
()	defines a marked subexpression	^(([A-Za-z0-9_-]+)[.]([A-Za-z0-9_-]+))+$
[]	defines a class of characters	[0-9] matches any one number (range class) [a.c] matches only “a” or “.” or “c” (list class)
[^]	matches a single character that is not contained within the brackets	[^abc] matches any char other than “a”, “b”, or “c” [^a-z] matches any single char that is not a lowercase letter from “a” to “z”
$	matches the ending position of the string or the position just before a string-ending newline	…[.]([A-Za-z0-9_-]+))+$
\|	matches either the expression before or the expression after the operator	abc\|def matches “abc” or “def”
\	changes metacharacter to literal	(.+) matches any expression containing at least one arbitrary character (\.+) matches any expression containing at least one dot character

Following table lists POSIX character classes for more comfortable programming:

Class	Description	Alternative
[:alpha:]	uppercase and lowercase letters	[A-Za-z]
[:alnum:]	uppercase and lowercase letters and numbers	[A-Za-z0-9]
[:cntrl:]	control characters like TAB, ESC or Backspace	-
[:digit:]	numbers from zero to nine	[0-9]
[:graph:]	ASCII (33-126) printable characters	-
[:lower:]	lowercase letters	[a-z]
[:punct:]	punctual characters: ~`!@#$%^&*()-_+={}[]:;’<>,.?/	-
[:upper:]	uppercase letters	[A-Z]
[:space:]	empty characters like space, newline, carriage return	-
[:xdigit:]	hexadecimal numbers	[a-fA-F0-9]

This table lists PHP POSIX regex functions:

Prototype	Description
int ereg (string $pattern, string $string [, array &$regs])	Searches a string for matches to the regular expression given in pattern in a case-sensitive way.
int eregi (string $pattern, string $string [, array &$regs])	This function is identical to ereg() except that it ignores case distinction when matching alphabetic characters.
string ereg_replace (string $pattern, string $replacement, string $string)	This function scans string for matches to pattern, then replaces the matched text with replacement.
string eregi_replace (string $pattern, string $replacement, string $string)	This function is identical to ereg_replace() except that ignores case distinction when matching alphabetic chars.
array split (string $pattern, string $string [, int $limit])	Splits a string into array by regular expression.
array spliti (string $pattern, string $string [, int $limit])	This function is identical to split() except that this ignores case distinction when matching alphabetic characters.
string sql_regcase (string $string)	Creates a regular expression for a case insensitive match.

Regular expressions are very usefull when we need to check some user inputs. If you have a contact form on your site which contains mandatory e-mail address field, how would you check whether user input string has valid e-mail format? Use regular expression match! Here are some examples for better understanding:

^(([A-Za-z0-9_-]+)[.]([A-Za-z0-9_-]+))+$ : matches a hostname expression (hostname.example.com)
^([0-9]{1,3})\.([0-9]{1,3})[.]([0-9]{1,3})\.([0-9]{1,3})$ : matches an IP address (192.168.10.122)
^([A-Za-z0-9._-]+)@([A-Za-z0-9._-]+)[.]([a-z]{2,4})$ : matches an e-mail address (mailbox@example.com)

Maybe you have noticed that sometimes there is a choice how to write regular expression pattern. In the first and third example above the dot character is expressed as a member of list class [.] whilst in the second example (IP address regexp) the dot is expressed as an escaped metacharacter \. at some places (this was done for demonstration purposes).

Another very important detail which should be noted is the fact that if you need to use metacharacters in a range class or list class it must be placed at the end of a content of such class, right before closing square bracket [... _-].

You can play with staed above examples by pasting the following code into a regexp.php file and run it in a browser:



POSIX Regexp Tester



    Enter String:

    

    Select Pattern:

    Hostname

    IP Address

    Email Address

    


' . $pattern . '
';
echo 'String: ' . $string . '

';

echo 'Match: ';
if (ereg($pattern, $string))
    echo 'OK';
else
    echo 'WRONG';
?>

I hope this post gave you at least basic overview of POSIX regular expressions and their use in PHP. In some of future articles we will take a look at Perl style regular expressions.

PHP and Excel

Administrator — Thu, 28 Aug 2008 08:13:19 +0000

Many of my customers hold data in Excel files. Then, when they decide to build a web based, database driven project controlled by PHP, ask me to move their Excel data into the MySQL. Whether it’s possible and how to do it, will be the content of this post.

Since the PHP allows you to create an OLE compatible COM object with its methods and properties, the solution is more than easy. All you need is take a brief look into the PHP COM Manual Pages to be able to understand the following explanatory example. I wrote this code as a PHP CLI script which seems to me more usable for interaction with other applications.

Before we start, let’s introduce input parameter of the function which is responsible for data retrieve from an Excel file and output it as a matrix, representing the Excel table.

$file - (string) absolute path to the Excel data file
$sheet - (int) order number of the sheet which data we want to extract
$rows - (array) rows selected from the sheet
$cols - (array) columns selected from the sheet

The names of variables were selected to represent their meaning (semantic names) and facilitate the understanding of script work. But if you’re still confused of input parameters or output, don’t be affraid, following examples will clarify it more. So, let’s move forward to the PHP and Excel interaction.

function getDataFromExcel($file, $sheet, $rows, $cols)
{
    // COM CREATE
    fwrite(STDOUT, "----------------------------------------\r\n");
    $excel = new COM("Excel.application") or die ("ERROR: Unable to instantaniate COM!\r\n");
    fwrite(STDOUT, "Application name: {$excel->Application->value}\r\n") ;
    fwrite(STDOUT, "Loaded version: {$excel->Application->version}\r\n");
    fwrite(STDOUT, "----------------------------------------\r\n\r\n");

    // DATA RETRIEVAL
    $Workbook = $excel->Workbooks->Open($file) or die("ERROR: Unable to open " . $file . "!\r\n");
    $Worksheet = $Workbook->Worksheets($sheet);
    $Worksheet->Activate;
    $i = 0;
    foreach ($rows as $row)
    {
        $i++; $j = 0;
        foreach ($cols as $col)
        {
            $j++;
            $cell = $Worksheet->Range($col . $row);
            $cell->activate();
            $matrix[$i][$j] = $cell->value;
        }
    }

    // COM DESTROY
    $Workbook->Close();
    unset($Worksheet);
    unset($Workbook);
    $excel->Workbooks->Close();
    $excel->Quit();
    unset($excel);

    return $matrix;
}

Now, when the key function is defined we can fire an extraction and insertion process:

// define inputs
$xls_path = "C:\\Users\\Johny\\Documents\\Business\\excel_data.xls"; // input file
$xls_sheet = 1; // sheet #1 from file excel_data.xls
$xls_rows = range(2, 270, 1); // I want extract rows 2 - 270 from excel_data.xls with step 1 row
$xls_cols = array("A", "B", "C", "D", "E", "F"); // I want to extract columns A - F from excel_data.xls

// initiate MySQL connection
mysql_connect("server", "username", "password") or die("Unable to connect MySQL server!");
mysql_select_db("database") or die("Unable to select requested database!");

// retrieve data from excel
$data = getDataFromExcel($xls_path, $xls_sheet, $xls_rows, $xls_cols);

// insert retrieved data into database
foreach ($data as $line)
{
    $i = 0;
    foreach ($line as $col => $entry)
    {
        // create the SET string for INSERT query
        $i++;
        $string .= "`" . $col . "` = '" . $entry . "'";
        if ($i < count($line))
            $string .= ", ";
    }
    mysql_query("INSERT INTO `table` SET " . $string . "");
}

The stated above example is simplified to emphasize the core of process, not necessary details may lead to unclear interpretation. It is supposed that readers have at least basic knowledge of PHP and MySQL.

So, as you can see there’s pretty simple way how to import data from excel file directly to database using PHP. The PHP COM interface allows you to do the same with many other types of application (Word, PowerPoint, etc.).

Date and Time in Windows Batch Files

Administrator — Wed, 09 Jul 2008 14:40:59 +0000

I’m sure you all often use date and time data to format filenames in batch files responsible for backups or logfiles routines. Those of you who administer Windows servers maybe encountered a syntax troubles using date and time system values to format required string as a filename. This post offers short guidance how to get necessary date or time substrings from Windows machines.

First, open the command line and display your current format of the date by typing:

echo %date%

Then, use the %date:~x,y% schema to extract desired substring from %date%, where:

x is starting character position of date substring
y is substring length

By typing %date% in the command line you’ll find out your current date format. Then, if you want your files to be named in format yyyymmdd-name.log use %date:~x,y% schema to create desired string representing a filename.

One example is better than hundreds of words: (date format on tested machine was ddmmyyyy)

C:\>echo %date%
We 09.07.2008

C:\>echo %date:~10,4%%date:~7,2%%date:~4,2%-name.log
20080709-name.log

So, you can create mysqlbackup.bat file (for example) with this content:

mysqldump -q -u root -prootpassword dbname > C:/Backup/dtb/%date:~10,4%%date:~7,2%%date:~4,2%-dbname.sql

Now, you just schedule to run this batch file by setting in Start > Control Panel > Scheduled Tasks > Add Scheduled Task and enjoy!

Tips:

when experimenting with substring, you can use the command line and let echo to display results of your attempts
you can use the minus sign right after the tilda (%date:~-x,y%) to count the x backwards
spaces, dots or slashes in date format (printed out by echo %date%) DOES matter!

All stated above works same with %time%.

Notice: Tested on Windows Server 2003 Standard Edition R2 SP2 and 32-bit Vista Business

DNS Leakage

Administrator — Sun, 29 Jun 2008 19:43:22 +0000

Couple of minutes ago one of our bots announced that has finished the DNS Leakage test. We decided to launch this test on request of one of our partner’s company which deals with private data auditing. They were interested in which sensitive information could be retrieved from the DNS.

Well, why not? We added the DNS Leakage task to one of our exploratory bots, selected the range of operation, scheduled it and waited. Below, you can see a part of the message sent by this bot after the test had finished:

Here are the results from the DNS Leakage Test:
Bot started at 2008-06-27 11:15:00 and ended at 2008-06-29 21:33:06 with following results.

Domains checked: 152422
Domains leaked: 34941

Leakage percentage: 23

OK, but what the DNS Leakage means, actually? It would be a separate article to explain the DNS (Domain Name System) deeply, even if there are many other sources covering this topic. As the best start, try this entry of the Wikipedia, I’m sure you’ll find exhaustive basics of the DNS itself.

Now, when we’re familiar with DNS, let’s take a closer look at its leakage. We talk about the DNS Leakage when authoritative nameserver for some domain allows to carry out the zone transfer to any client. There should be the list of authorized clients to get all entries of some domain. Nameservers should distinguish beetwen private and public information and handle with it carefully. Some data in the hands of some individuals can leads to security degradation. Here is one of records gathered by our test bot during the DNS Leakage test:

; @ns.somehosting.net example.com AXFR
; (1 server found)
;; global options: printcmd
example.com. 3600 IN SOA ns.somehosting.net. charlie.somehosting.net. 2008042230 900 600 86400 3600
example.com. 3600 IN NS ns.somehosting.net.
example.com. 3600 IN NS ns.otherhosting.net.
example.com. 3600 IN MX 30 mx1.example.com.
example.com. 3600 IN MX 10 mx3.example.com.
ns.otherhosting.net. 3600 IN A XXX.YYY.WWW.ZZZ
fruits.example.com. 3600 IN A XXX.YYY.WWW.ZZZ
andy.example.com. 3600 IN A XXX.YYY.WWW.ZZZ
mx1.example.com. 3600 IN A XXX.YYY.WWW.ZZZ
mx3.example.com. 3600 IN A XXX.YYY.WWW.ZZZ
doggy1.example.com. 3600 IN A XXX.YYY.WWW.ZZZ
xav.example.com. 3600 IN A XXX.YYY.WWW.ZZZ
aportal.example.com. 3600 IN A XXX.YYY.WWW.ZZZ
bportal.example.com. 3600 IN A XXX.YYY.WWW.ZZZ
nemo.example.com. 3600 IN CNAME nemo.example.com.
gw.example.com. 3600 IN A XXX.YYY.WWW.ZZZ
test.example.com. 3600 IN A XXX.YYY.WWW.ZZZ
test1.example.com. 3600 IN A XXX.YYY.WWW.ZZZ
alan.example.com. 3600 IN A XXX.YYY.WWW.ZZZ
reports.example.com. 3600 IN A XXX.YYY.WWW.ZZZ
www.example.com. 3600 IN CNAME xav.example.com.
www1.example.com. 3600 IN CNAME aportal.example.com.
example.com. 3600 IN SOA ns.somehosting.net. charlie.somehosting.net. 2008042230 900 600 86400 3600
;; Query time: 187 msec
;; SERVER: XXX.YYY.WWW.ZZZ#53(XXX.YYY.WWW.ZZZ)
;; WHEN: Sat Jun 28 19:31:34 2008
;; XFR size: 23 records (messages 23)

As you can see from listing above, authoritative nameserver ns.somehosting.net allowed full zone transfer of domain example.com to our test bot, thus to any other client. I’m sure some data retrieved should NOT be available to the public, e.g. names and IP addresses of non public (hidden, local) servers, which are not intended to be reachable from outside.

The stated above situation is an example of the DNS Leakage, when authoritative nameserver leaks information which should not be public. System administrators of nameservers should prevent the DNS Leakage of their part of the DNS by allowing zone transfer to authorized servers only. To fulfil this task successfully, anyone is welcome to use our Check DNS Leak tool for free.

Notice: To prevent abuse of some data in the example, domain name, nameservers and IP adressess in the DNS Leakage test results have been changed.

JavaScript XMLHttpRequest Object

Administrator — Fri, 16 May 2008 16:03:42 +0000

XMLHttpRequest is one of the goals of AJAX technology. But what XMLHttpRequest actually is, where it comes from or how we can use it will be the content of this short post.

There are more definitions of the XMLHttpRequest. It depends on what side you are looking at from. From my side of view, the XMLHttpRequest Object is property of JavaScript Window Object.

As any other object, the XMLHttpRequest has its properties and methods. Here they are:

XMPHttpRequest PROPERTIES:

Property	Description	Notes
onreadystatechange	Sets or retrieves the event handler for asynchronous requests.	usually a function name
readyState	Retrieves the current state of the request operation.	returns an integer representing defined states: 0 = Uninitialized: The object has been created, but not initialized (the open method has not been called). 1 = Open: The object has been created, but the send method has not been called. 2 = Sent: The send method has been called. responseText is not available. responseBody is not available. 3 = Receiving: Some data has been received. responseText is not available. responseBody is not available. 4 = Loaded: All the data has been received. responseText is available. responseBody is available.
status	Retrieves the HTTP status code of the request.	returns an integer, e.g. 404 for “Not Found” or 200 for “OK”
statusText	Retrieves the friendly HTTP status of the request.	returns string, e.g. “Not Found” or “OK“
responseText	Retrieves the response body as a string.	returns string
responseBody	Retrieves the response body as an array of unsigned bytes.	returns binary encoded string
responseXML	Retrieves the response body as an XML DOM object.	returns an XML document object

XMPHttpRequest METHODS:

Method	Description	Notes
open(sMethod, sUrl [, bAsync] [, sUser] [, sPassword])	Assigns method, destination URL, and other optional attributes of a pending request.	sMethod: Required. String that specifies the HTTP method used to open the connection: such as GET, POST, or HEAD. This parameter is not case-sensitive. sUrl: Required. String that specifies either the absolute or a relative URL of the XML data or server-side XML Web services. bAsync: Optional. Variant that specifies true for asynchronous operation (the call returns immediately), or false for synchronous operation. sUser: Optional. Variant that specifies the name of the user for authentication. sPassword: Optional. Variant that specifies the password for authentication.
send([varBody])	Sends an HTTP request to the server and receives a response.	varBody: Optional. Variant that specifies the body of the message being sent with the request.
abort()	Cancels the current HTTP request.
setRequestHeader(sName, sValue)	Adds custom HTTP headers to the request.	sName: Required. String that specifies the header name. sValue: Required. String that specifies the header value.
getResponseHeader(bstrHeader)	Returns the specified response header.	bstrHeader: Required. String that specifies the response header name.
getAllResponseHeaders()	Returns the complete list of response headers.

We also can find an EVENT in the XMLHttpRequest:

Event	Description	Notes
ontimeout	Raised when there is an error that prevents the completion of the request.

Here is an example of XMLHttpRequest Object using:

function moveCalendar(month, year)
{
    var xmlHttp;
    // Create xmlHttp Object
    try
    {
        // Firefox, Opera 8.0+, Safari
        xmlHttp = new XMLHttpRequest();
    }
    catch (e)
    {
        try
        {
            // Internet Explorer
            xmlHttp = new ActiveXObject("Msxml2.XMLHTTP");
        }
        catch (e)
        {
            try
            {
                xmlHttp = new ActiveXObject("Microsoft.XMLHTTP");
            }
            catch (e)
            {
                alert("Your browser does not support AJAX!");
                return false;
            }
        }
    }
    // Event Handler - EventListener
    xmlHttp.onreadystatechange = function()
    {
        if (xmlHttp.readyState == 4) // 4: The Request is complete
        {
            document.getElementById('calendar').innerHTML = xmlHttp.responseText; // Response
        }
    }
    // Request
    xmlHttp.open("GET", "/modules/mod_calendar.php?month="+month+"&year="+year, true);
    xmlHttp.send(null);
}

Stated above example tries to create an XMLHttpRequest Object. If successfull, a function is triggered by XMLHttp state change which reacts to the request represented by last two lines of the code. PHP script (calendar module in this case) expects a GET requests and returns the HTML code of the calendar portion (a month) specified by request (month and year). This returned code is then pushed into the page code by setting the HTML DOM property innerHTML to the value of XMLHttp response.

But what is this complicated manner good for? The main advantage is that by using XMLHttpRequest Object you don’t have to reload whole page when trying to retrieve some information. There’s just small part of page changed which result in very fast, dynamic effect of updating the data. Also, pushing a data to database is carried out much effective in case of XMLHttpRequest Object use.

Coding a script using XMLHttpRequest Object can be done manually (every action is coded separately) or you can use one of the frameworks which incorporates AJAX or offers nice interface to your existing PHP code. I personally, prefer the second type, so I use the xAJAX library where an XMLHttpRequest Object should be convenient. The goal of the xAJAX object is that you don’t have to change anything in your existing application source code. Just load the library, create object, register the function or class you want to handle by AJAX and that’s it!

Finally, there should be noted that from security reasons the XMLHttpRequest Object works within a domain only! It means that call of some location outside the domain leads to security error like this:

Error: uncaught exception: [Exception... "Access to restricted URI denied" code: "1012" nsresult: "0x805303f4 (NS_ERROR_DOM_BAD_URI)" location: "http://www.testfiles.loc/js/testfile.js Line: 43"]

I hope, this brief intro into the XMLHttpRequest Object gave you at least basic overview of AJAX technology.

Advanced Security Related PHP Directives

Administrator — Wed, 30 Apr 2008 19:59:26 +0000

Previous post Basic Security Related PHP Directives showed us the basic set of PHP directives which significantly affects security of not PHP apps only. This article increases the spectrum of PHP security related configuration directives.

disable_functions (string)
Scope: PHP_INI_SYSTEM | Default value: Null
If you think that safe mode limits you too much, you can use this directive to disable some potentially unsecure functions only. For example, disable_functions = fopen,popen,file disables functions fopen(), popen() and file(). This directive doesn’t depend on status of safe mode (on/off).

disable_classes (string)
Scope: PHP_INI_SYSTEM | Default value: Null
This directive allows you to disable some of your own PHP classes which you don’t want to expose to others. For example, disable_classes = “administrator, accounting” you’ll completely turn these classes off. Effect of this directive doesn’t depend on safe_mode.

doc_root (string)
Scope: PHP_INI_SYSTEM | Default value: Null
By this directive you can set the path, which specifies the root directory from which PHP files will be served. If directive doc_root is not set (is empty), it will be ignored and PHP scripts will be executed as are specified by the URL. In the case when safe mode is on and doc_root is not empty, there are no PHP scripts executed outside of path specified by this directive.

max_execution_time (integer)
Scope: PHP_INI_ALL | Default value: 30
This directive specifies how long the script can run before will be terminated. By using this directive you can prevent scripts to consume all CPU time. It’s set up to 30 seconds by default. Set to 0 (zero) means no limit.

memory_limit (integer)
Scope: PHP_INI_ALL | Default value: 8M
Directive specifies how much memory the script may use. Default value is 8 MB. There are no other units besides megabytes allowed and there must be the letter M stated after value. This directive is effective when PHP was configured with option –enable-memory-limit on only.

open_basedir (string)
Scope: PHP_INI_SYSTEM | Default value: Null
By directive open_basedir you can create directory on which all PHP file operations will be limited. This is something like DocumentRoot for Apache. You can prevent users to access areas which are not authorized for them. Let’s supose your web content is located in /home/www. You might want to prevent users to disclose files like /etc/passwd and manipulate with them by couple of PHP simple commands. This could be done by setting open_basedir = “/home/www/”. The effect of this directive does not depend on safe_mode directive.

sql.safe_mode (integer)
Scope: PHP_INI_SYSTEM | Default value: 0
If the sql.safe_mode is on, PHP ignores all information passed into mysql_connect() and mysql_pconnect() in which something other than localhost is used as the target host. The user under which PHP runs will be used as username, no password is used.

user_dir (string)
Scope: PHP_INI_SYSTEM | Default value: Null
This directive specifies name of directory in the user home directory in which PHP scripts must be located to be authorized to execute. For example, if user_dir is set up to scripts and “Johny” wants to execute somescript.php, Johny must create directory named scripts in his home directory and place somescript.php in there. Access to that script si via the URL http://www.example.com/~johny/scripts/somescript.php. user_dir is very often used together with configuration directive UserDir of Apache.

Basic Security Related PHP Directives

Administrator — Mon, 28 Apr 2008 17:54:24 +0000

Configuration of PHP is one of the significant security breakpoints. There is no doubt that ignoring this can lead to serious security consequencies. I’m not talking just about web applications vulnerabilities. Wrong PHP setup can allow to take your server under control by some invader. This article is trying to help you to do more for your calm sleep.

PHP has available built-in safe mode, by using which we can improve security distinctly. Before we move to directives, let’s remind their scopes of modification to have clear where we can use them.

PHP defines these four scopes:

PHP_INI_PERDIR. Directive can be modified in php.ini, httpd.conf or .htaccess
PHP_INI_SYSTEM. Directive can be modified in php.ini and httpd.conf
PHP_INI_USER. Directive can be modified in user scripts
PHP_INI_ALL. Directive can be modified wherever

Now we can move forward and go through basic security settings of PHP.

safe_mode (boolen)
Scope: PHP_INI_SYSTEM | Default value: 0
By turning safe_mode on we can limit some of potentially dangerous options of PHP. Safe mode can be turned on by setting safe_mode directive to the boolean value on or turned off by setting it to off. Restrictive schema is based on UID (User ID) comparison of running script with file UID to wich the script tries to access. If both UID are same, script is authorized to continue, otherwise failes.

safe_mode_gid (boolean)
Scope: PHP_INI_SYSTEM | Default value: 0
This directive changes behaviour of the safe mode by checking GID (Group ID) instead of UID (User ID). So, if Mary and John are members of the same group, scripts of Mary are authorized to call fopen() to files of John.

safe_mode_include_dir (string)
Scope: PHP_INI_SYSTEM | Default value: Null
By safe_mode_include_dir directive we can mark out some paths in which the safe mode should be ignored, even if it‘s on. This is often used for directories in which various stuff for more web users is placed (ex. templates). Syntax allows more directories separated by semi-colon.

safe_mode_exec_dir (string)
Scope: PHP_INI_SYSTEM | Default value: Null
This directive specifies the directory where system programs executable by system(), exec() or passthru() reside. There is necessary have the safe_mode on.

safe_mode_allowed_env_vars (string)
Scope: PHP_INI_SYSTEM | Default value: PHP_
When the safe_mode is on, by this directive we can permit modification of some system environmental variables from user’s script. Syntax allows more variables separated by comma.

safe_mode_protected_env_vars (string)
Scope: PHP_INI_SYSTEM | Default value: LD_LIBRARY_PATH
This directive prevents modification of some system environmental variables by putenv() function. The LD_LIBRARY_PATH is protected by default. Variables declared here overlay variables set up by safe_mode_allowed_env_vars directive.

In the next post we’ll take a look at advanced security settings of PHP.