whereis php.ini

usr/local/lib/php.ini

/etc/php.ini

pico -w /etc/php.ini

pico /usr/local/lib/php.ini

disable_functions = "system,exec"

disable_functions = "exec,system,passthru,readfile,shell_exec,escapeshellarg,escapeshellcmd,proc_c
lose,proc_open,ini_alter,dl,popen,parse_ini_file,show_source,curl_exec"

< IfModule mod_php4.c / >
php_admin_value open_basedir "/home/USER/public_html:/home/USER:/usr/lib/php

Hello Hamada,
a great topic just like your presenter , i would like to discuss more and more about php secuering .. 1st of all " exec" function classed as most disestar maker funtion ever but so many project need to execute shell commands through php , so we cant warranty 100% this function hasn been disabled
also there is File handling functions like fopen, file_get_contents, and include accept URLs as file parameters (for example: fopen('http://www.example.com/', 'r')). Even though this enables developers to access remote resources like HTTP URLs, it poses as a huge security risk if the filename is taken from user input without proper sanitization, and opens the door for remote code execution on the server. To disable this and limit file functions to local system, use the following
also php has a safe mode. In this mode, access to files not owned by Apache is disabled, and access to environment variables and execution of binary programs are also disabled.
In its default state, PHP's safe mode is too restrictive for any advanced development to be possible. However, there are several settings to relax it. The biggest problem with safe mode is that only files owned by Apache are accessible to PHP scripts. This is often impractical when many developers are working on the same project, or when you want PHP to read a file without changing its ownership. Another affected situation is when you want PHP to read files generated by other programs. To work around this, there is a setting that checks for file group instead of owner:
With safe_mode_gid enabled instead of safe_mode, PHP will be able to open files that belong to Apache's group regardless of the owner. So if there are several developers working on the same server, add them to Apache's group, make it their default group, and everything should be set
Safe mode is also useful in stopping PHP from executing binaries, but sometimes you may need to let it run specific programs. In this case place these binaries (or symbolic links to them) in a directory (/var/www/binaries for instance) and use the following option:
Finally, to allow access to certain environment variables, use the following setting, providing a comma-separated list of prefixes. Only environment variables which names begin with one of the prefixes will be accessible

all " exec" function classed as most disestar maker funtion ever but so many project need to execute shell commands through php , so we cant warranty 100% this function hasn been disabled

if the filename is taken from user input without proper sanitization,

php has a safe mode.

copy("compress.zlib:///etc/passwd", "/home/cxib/to/bandyta/passwd.txt");

Salam
may i take this in action i answer you !
1st of all i'll start with defntion of http.conf file, the main configuration file of apache is usually called httpd.conf. The location of this file is set at compile-time, but may be overridden with the
-f command line flag , in this file you can add you site Vdir and set ur configuration paramiters as well, using so many known statment
Example:

<VirtualHost 10.1.2.3>
ServerAdmin webmaster@host.com
DocumentRoot /www/docs/host.com
ServerName host.foo.com
ErrorLog logs/host.com-error_log
TransferLog logs/host.access_log
</VirtualHost>

and so many other statment depend on ur need,s
-----------------------------------------------------
Suhosin is an advanced protection system for PHP installations. It was designed to protect servers and users from known and unknown flaws in PHP applications and the PHP core. Suhosin comes in two independent parts, that can be used separately or in combination. The first part is a small patch against the PHP core, that implements a few low-level protections against buffer overflows or format string vulnerabilities and the second part is a powerful PHP extension that implements all the other protections

about servers i believe in the following Intel P4 2.8 Dual Core 920 160GB SATA Hard Drive Bandwidth: 2000GB 100 Mbit Switch Port OS RHEL 4 configure with php and Lighttpd/apache 2