As is well known, PHP is one of the most widely used web programming languages today. It is supported by a very large number of function libraries and extension modules, …
Because PHP is extended by functions that can interact with and execute directly against the host system, those functions carry real risk — and if system administrators do not take security seriously, the consequences can be severe.
Nearly all hosting providers worldwide are compelled to disable certain PHP functions for security reasons (malware distribution, local attacks, botnets, DoS, and similar risks) — these are functions that hosting providers around the world consider extremely dangerous.
To understand the issue, why these functions are blocked and which ones must be blocked, see the descriptions in the table below:

STT	Name	Features	Description
1	system	Execute an external program and display the output	system() behaves like the C version of the function: it executes the given command and returns the output. The system() call also attempts to flush the web server's output buffer automatically after each line of output if PHP is running as a server module. If you need to execute a command and have all data from the command passed straight back without interference, use the passthru() function.
2	exec	Run an external program	Allows an external program to be executed. Easily abused to escalate privileges and run malicious programs.
3	shell_exec	Executes a command through the shell and returns the complete output as a string	Executes a command and returns the result as a string. Like exec, it is easily abused and exploited for malicious purposes.
4	proc_close	Closes a process opened by proc_open() and returns that process's exit code	proc_close() is similar to pclose(), except that it works only on processes opened by proc_open(). proc_close() waits for the process to terminate and returns its exit code. If you have pipes open to that process, close them with fclose() before calling this function to avoid a deadlock — the child process may be unable to exit while the pipes are open.
5	proc_get_status	Get information about a process opened by Proc_open ()	proc_get_status() retrieves data about a process opened with proc_open().
6	proc_nice	Change the priority of the current process	Changes the priority of the current process. This causes a resource escalation problem.
7	popen	Open the process file handle	popen is similar to proc_open but is used less often.
8	proc_terminate	Close a process opened by Proc_open	Signals a process (created with proc_open()) to terminate. proc_terminate() returns immediately and does not wait for the process to end, allowing you to terminate the process and move on to other work. You can poll the process (to check whether it has stopped) with proc_get_status(). This makes it easy for important running processes to be interrupted by this function, which can have serious consequences and create data security problems.
9	escapeshellcmd	Escape shell metacharacters	escapeshellcmd() escapes any character in a string that could be used to trick a shell command into executing arbitrary commands. Use this function to ensure that data originating from user input is escaped before it is passed to exec(), system() or the backtick operator. The following characters are prefixed with a backslash: & # ; ` \| * ? ~ < > ^ ( ) [ ] { } $ , \x0A and \xFF. Single and double quotes are escaped only when they are unpaired. On Windows, all of these characters plus % and ! are replaced with spaces.
10	escapeshellcmd	Escape a string used as a shell argument	escapeshellarg() adds single quotes around a string and quotes or escapes any existing single quotes, allowing you to pass a string directly to a shell function and have it treated as a single safe argument. Use this function to escape individual arguments to shell functions when those arguments come from user input. Shell functions include exec(), system() and the backtick operator. On Windows, escapeshellarg() replaces percent signs, exclamation marks (delayed variable substitution) and double quotes with spaces, and adds double quotes around the string.
11	dl	Load a PHP extension at runtime	Loads the PHP extension given by the library parameter. Use extension_loaded() to test whether a given extension is available. This works for both built-in extensions and those loaded dynamically (either through php.ini or dl()).
12	show_source	Returns a file with its PHP syntax highlighted. The highlighting is applied using HTML tags.	Prints or returns a syntax-highlighted version of the code in the given file, using the colors defined in PHP's built-in syntax highlighter. Many servers are configured to automatically highlight files with the .phps extension. For example, viewing example.phps will display the source of the file with syntax highlighting
13	ini_alter	This function is an alias of: ini_set()	Sets the value of the given configuration option. The option keeps this new value for the duration of the script and is restored when the script ends.
14	virtual	Perform an Apache subrequest	Perform an Apache subrequest
15	openlog	Opens a connection to the system logger for a program	Opens a connection to the system logger for a program
16	mail	Sending mail without authentication	Sending mail without authentication
17	symlink	Create a symbolic link	Create a symbolic link

The table above lists the PHP functions that have been disabled (disable functions). So which PHP/Apache functions and modules are supported? The table below sets them out in detail:

STT	Apache Module	PHP Extention
1	config	libc-client
2	config-runtime	pear
3	devel	php-bcmath
4	mod-alt-passenger	php-bz2
5	mod_bwlimited	php-calendar
6	mod_cache	php-cli
7	mod_cgid	php-common
8	mod_charset_lite	php-curl
9	mod_deflate	php-dba
10	mod_env	php-devel
11	mod_evasive	php-enchant
12	mod_expires	php-exif
13	mod_file_cache	php-fileinfo
14	mod_headers	php-fpm
15	mod_hostinglimits	php-ftp
16	mod_http2	php-gd
17	mod_imagemap	php-gettext
18	mod_lsapi	php-gmp
19	mod_macro	php-iconv
20	mod_mime_magic	php-imap
21	mod_mpm_event	php-intl
22	mod_proxy	php-ioncube
23	mod_proxy_fcgi	php-litespeed
24	mod_proxy_http	php-mbstring
25	mod_proxy_wstunnel	php-mcrypt
26	mod_remoteip	php-mysqlnd
27	mod_reqtimeout	php-odbc
28	mod_security2	php-pdo
29	mod_speling	php-phalcon
30	mod_ssl	php-posix
31	mod_substitute	php-soap
32	mod_suexec	php-sockets
33	mod_unique_id	php-sourceguardian
34	mod_version	php-suhosin
35	mod_vhost_alias	php-tidy
36	Tools	php-xml
37		php-zendguard
38		php-zip
39		runtime