Disable the ability to access functions through variables?

Question

PHP

I found an injection of the form:

$x = "\x66\x69\x6ce\137\x67\x65t_\143\157\156\164\x65\156t\x73"; // "file_get_contents"
 echo $x("test.php");

this code executes Question: How to disable unwanted functionalityecho file_get_contents("test.php");
at the level of php settings ?

Answer 1

It's strange to close an exploit instead of a vulnerability.

Answer 2

No way. These are language constructs.
The most you can do is disable some functions:
disable_functions = file_get_contents

Answer 3

1) Do not save FTP passwords in FTP clients and do not get infected by a virus that steals them
2) If you install phpMyAdmin, plugins for Wordpress, and other open source software of unknown quality on the server, block access to it via HTTP authorization (via password). Automatic scanners that bypass the network looking for vulnerabilities will fail.
3) If you are making a site where users can upload files, upload their files to a folder where PHP scripts are disabled.
4) If you download free CMS themes, plugins, Wordpress themes not from the official and moderated site, check if they contain code inserts. You know where the free cheese is!
Following these 4 simple rules protects against almost all vulnerabilities and you will not have this situation again.