6 הגדרות אבטחה חשובות  ב php.ini

ההגדרות שלהלן יעזרו לכם להפוך את האתר שלכם למאובטח יותר. ישנם קבצים נוספים שעוזרים למנוע התקפות זדוניות לאתר שלך, כמו. Htaccess וglobals.php, אבל php.ini הוא נקודת ההתחלה הטובה לכל מי שלוקח את עניין האבטחה ברצינות. רכיבים מסוימים עלולים  שלא לעבוד עם ההגדרות, לכן כדאי לשקול אם אתה באמת צריך התוספות הללו

register_globals = off (or = 0)

If this is left on, an attacker might use this to insert request variables from HTML forms with the intention to break your website.
In PHP5, its default state is set to off and as of PHP6 it has been removed.

allow_url_fopen = off

The preferred setting is default. This function will treat remote files as if they were local files on the server, leaving some open space to malicious attacks.

magic_quotes_gpc

This is on by default. Its main purpose is to escape all variables that are sent to the database, neutralizing malicious loaded scripts. You should never turn this off.
This setting has been removed in PHP6.

expose_php = off

The default value is on. This setting will prevent malicious users from finding out the PHP version you are using as well as 3rd party PHP extensions. By setting this to off, it reduces the amount of exposed information.

safe_mode = off

You should leave this in its default state (off). If you turn it on, some features will be disabled [chmod(), exec(), system() and more].
As of PHP6 it has been removed.

session.use_trans_sid = off

It prevents or lowers the possibility of a session fixation attack.

מקור באנגלית