phpinfo() exposes server details
Why it matters
phpinfo() reveals the PHP version, file paths, loaded modules and environment variables: a map attackers use to choose their exploit.
// info.php
phpinfo();// Delete info.php from production.
// Check settings from the command line instead:
// php -i | grep display_errorsHow to fix
Remove phpinfo() from anything reachable in production.
Scan my code
Scan my code β
Paste a file and PHP Safe points to every line that matches this rule.