There is a technology to prevent the execution of malicious php code. Refine. Do you have any other ideas or comments?

Question

PHP

No php files can be executed on the site due to the fact that they cannot be accessed via http (written in htaccess). Access via http is allowed only to one file - index.php. The only way to execute a php file is if index.php includes it. index.php includes any file on the server, the path to which is passed to it by the global variable $_GET[p].
Let's assume that we passed the $_GET[p] argument to the index.php file with the value "./script.php".
Then, to avoid executing malicious code, index.php will check script.php for the presence of such before including it. It will copy the contents of script.php into the $script variable, remove all escaping functions from the variable, and check $script with preg_match() for lines that might delete or change important files. If malicious code is found, then index.php will not include script.php.

Answer 1

1. The php code validator on php consists of one line - error_reporting(E_ALL | E_STRICT), better not yet invented.
2. It is necessary to lock the file for writing only at the level of system software with sufficient rights, and, accordingly, with limited execution rights, and not in any way "to detect lines of code in the file that change such and such a file." Even if we filter all the file writing / deleting functions in the code, I can suggest two workarounds:
a) unpacking the loaded archive with the replacement of the "untouchable" file.
b) execution of any reversibly-encrypted piece of code with a key (do not filter with anything).

Answer 2

They say the truth - one fool will put ten wise men to a standstill.
Garbage from this head must be taken out by wagons.
Are you, for an hour, not from this unfortunate team?

Answer 3

What kind of nonsense? Recently, there have been a lot of drug addicts on the toaster ..