PHP error guide

Function disabled by disable_functions: meaning and fix

fatal server Affects: PHP 7.4–8.4; disabled function behavior changed in PHP 8.0 Last verified:

Error summary

Remove the application dependency on the disabled function or make a narrowly reviewed site-specific policy change; never bypass the restriction.

What it means

Remove the application dependency on the disabled function or make a narrowly reviewed site-specific policy change; never bypass the restriction.

What the error means

On modern PHP, functions listed in disable_functions can be removed from the function table and calls appear undefined.

Why PHP produces it

The active SAPI configuration prohibits a function required by the application.

PHP version notes

As of PHP 8.0, disabled internal functions can be removed from the function table; older releases may use different warning text.

Most common causes

  • exec, shell_exec, proc_open, or another function is disabled.
  • CLI and FPM have different disable_functions lists.
  • Hosting policy prevents local process execution.

Minimal examples

BAD — reproduces the problem

php 
$output = exec("cat " . $_GET["file"]);

FIXED — safer pattern

php 
$output = file_get_contents($validatedPath);

Step-by-step diagnosis

  1. Inspect ini_get("disable_functions") in the affected SAPI.
  2. Check function_exists for the exact function.
  3. Trace why the application needs the function and whether a native API exists.

Fixes

Use an allowed application design

Replace shell delegation with a PHP or service API where possible.

php 
$contents = file_get_contents($path);
if ($contents === false) {
    throw new RuntimeException("Read failed");
}

Common mistakes when fixing it

  • Trying obfuscated aliases to bypass policy.
  • Removing the global restriction without reviewing other sites.
  • Building shell commands from request data.

How to prevent it

  • Audit required functions before deployment.
  • Prefer native libraries and service APIs.
  • Document site-specific security policy.

Web server / environment notes

fpm, apache, cli, shared-hosting. The directive is system-level and can differ by SAPI or pool.

Tags: fpm,apache,cli,shared-hosting

Categories