Should I allow 'allow_url_fopen' in PHP?
configuration, php
Solution
You definitely want `allow_url_include` set to Off, which mitigates many of the risks of `allow_url_fopen` as well.
But because not all versions of PHP have `allow_url_include`, best practice for many is to turn off fopen. Like with all features, the reality is that if you don't need it for your application, disable it. If you do need it, the curl module probably can do it better, and refactoring your application to use curl to disable `allow_url_fopen` may deter the least determined cracker.
Problem
We have a couple of developers asking for `allow_url_fopen` to be enabled on our server. What's the norm these days and if `libcurl` is enabled is there really any good reason to allow? Environment is: Windows 2003, PHP 5.2.6, FastCGI