Is there a white list of php functions?

Question

PHP

There are two questions:
first, it is necessary to create a white list of functions for the user to use. so that functions such as popen, pclose, exec, system, include, etc. are excluded.
Has anyone done this?
and secondly, what dangers can the code executed through cmd cause. That is, a php file is executed that calls cmd and then executes some instructions. what can it threaten?

Answer 1

so that functions such as popen,pclose,exec,system,include are excluded

in php.ini
It is also possible not globally but for the user to make a separate php.ini and list the prohibited functions there.

Answer 2

Once played with such a thing: evileval.sourceforge.net