The problem with disable_functions is that eval is not an internal function, but a language construct. From the manual:
Only internal functions can be disabled using this directive.
It is possible to generate something like a list of all available internal functions, eval is missing here:
$arr = get_defined_functions();
var_dump($arr['internal']);
http://www.hardened-php.net/suhosin/configuration.html#suhos...
Apologies, you are correct, I was thinking of exec.
Re:Alert: Backdoor placed in Piwik
by degenerate on Tuesday November 27, 2012 @09:51AM
(#4837335)
And how to use it:
http://www.cyberciti.biz/faq/linux-unix-apache-lighttpd-phpi...
Just remove anything you use. I use cURL, so I took it out.
[1] http://php.net/manual/en/ini.core.php#ini.disable-functions
Edit: Also, as noted below, this wouldn't prevent this or many other similar hacks as you need write access to the PHP script to put the eval in in the first place, so you could just write other code in there directly (and pull in extra scripts to execute by writing to disk etc. if necessary). Eval is typically dangerous, in its own right, when it is used by the legitimate developer who then allows unchecked code to be passed to it.