Tips for Using PHP in Safe Mode

Internet Service Providers use the PHP safe mode in order to control security issues on shared servers. When PHP runs in safe mode many features determined by the actual configuration directives will not be available.

Practically, the safe mode implements many restrictions and for this reason many popular PHP scripts will not work at all or they could be installed, but their functionality will be limited. On the other hand, PHP safe mode will disable functions that could be used to create damages to the server or websites content.

When PHP is installed as an Apache module, its settings can be changed with the help of Apache configuration files (.httpd) and .htaccess files. To enable or disable PHP safe mode for the entire web server you can use the php.ini file. This file allows you to modify many aspects of PHP configuration, including the safe mode directives.

If you own a web server, then you have access to all PHP and Apache configuration files, but, if you have more php.ini files instances, the one you are looking for can be found with the help of the next PHP script, which will show you the path to the loaded configuration file:


Then, you must find the line corresponding to safe mode options and set the desired value (On or Off) for safe_mode. If you are having an account on a shared web server then your ISP must configure the safe mode directive for PHP. On free web hosting accounts (where the safe mode is present) there could be alternatives to enable functions or other limited PHP directives. When adequate permissions exist, a php.ini file identical with the default one can be added in the PHP script directory or in the root of your website after you perform the desired modifications.

If you do not have access to the main php.ini file in order to get a copy, the function ini_set will help you to enable or disable PHP directives directly from your scripts. From practice, results the fact that even you succeed in enabling some of the PHP directives disallowed in safe mode, the best results will still be obtained by disabling PHP safe mode, if this is the server side application requirement. Fortunately, beginning with PHP version 6, the safe_mode not longer exists. In conclusion, you should always choose a hosting service providing flexibility in PHP directives configuration.