The enable_dl PHP configuration setting allows PHP extensions to be loaded dynamically at runtime.

Why is this an issue?

When dynamic loading is enabled, PHP code can load arbitrary PHP extensions by calling the dl function. This can be used to bypass restrictions set with the open_basedir configuration.

PHP defaults to allowing dynamic loading.

How to fix it

enable_dl setting should be set to 0 in the main PHP configuration.

Code examples

Noncompliant code example

; php.ini
enable_dl=1  ; Noncompliant

Compliant solution

; php.ini
enable_dl=0

Resources

Standards