The problem with disable_functions is that eval is not an internal function, but a language construct. From the manual: Only internal functions can be disabled

The problem with disable_functions is that eval is not an internal function, but a language construct. From the manual: Only internal functions can be disabled using this directive. It is possible to generate something like a list of all available internal functions, eval is missing here: $arr = get_defined_functions(); var_dump($arr['internal']); The Suhosin extension will let you block eval, if it is available: http://www.hardened-php.net/suhosin/configuration.html#suhosin.executor.disable_eval http://www.hardened-php.net/suhosin/configuration.html#suhos...