<p>Craft uses MySQL's native <a href="https://dev.mysql.com/doc/refman/8.0/en/mysqldump.html" rel="nofollow noreferrer">mysqldump</a> and PostgreSQL's <a href="https://www.postgresql.org/docs/10/static/app-pgdump.html" rel="nofollow noreferrer">pg_dump</a> binaries to create database backups.</p>

<p>In order for PHP to be able to execute those binaries, it needs to be able to run the <code>proc_open</code> and <code>proc_close</code> PHP commands.</p>

<p>I would not consider it a security issue, but if you were really concerned about it, you can <a href="https://docs.craftcms.com/api/v3/craft-config-generalconfig.html#$backupOnUpdate-detail" rel="nofollow noreferrer">prevent Craft from making backups on update</a> and/or specify your own <a href="https://docs.craftcms.com/api/v3/craft-config-generalconfig.html#$backupCommand-detail" rel="nofollow noreferrer">backup logic</a> bypassing Craft's default implementation.</p>

CC BY-SA 4.0
2018-09-26T20:10:23.220Z
How did Craft 2 do it? Craft 2 worked flawlessly with openbasedir, Craft 3 does not.
Anders
CC BY-SA 4.0
2018-10-05T22:04:13.077Z
Not sure what this post has to do with openbasedir?
Brad Bell
CC BY-SA 4.0
2018-10-06T01:46:41.387Z
openbasedir disables proc_open(), no? That seems to be how shared hosting typically works in any case.
Anders
CC BY-SA 4.0
2018-10-06T08:29:24.413Z
Ahh, a host that might use openbase_dir, might also happen to disable some proc_ methods, but they are technically unrelated.
Brad Bell
CC BY-SA 3.0
2018-04-30T23:57:17.020Z
2018-04-30T23:57:17.020Z
Brad Bell
<p>Why do I have to activate the PHP functions: &quot;proc_open&quot; and &quot;proc_close&quot; to backup the database?</p>
<p>I got the error logs:</p>
<blockquote>
<p>[error][yii\base\Exception] yii\base\Exception: Could not create backup: proc_open() has been disabled for security reasons in /home/velolade/craft3veloladen_daten/vendor/craftcms/cms/src/controllers/UtilitiesController.php:383</p>
<p>[error][yii\base\Exception] yii\base\Exception: Could not create backup: proc_close() has been disabled for security reasons in /home/velolade/craft3veloladen_daten/vendor/craftcms/cms/src/controllers/UtilitiesController.php:383</p>
</blockquote>
<p>After activating these functions in my hoster's PHP settings, it worked.
Is this a security problem for my website?</p>
<p>Thank you very much!</p>

<craft3><database><security><back-up>
Craft 3 Database Backup
# Craft 3 Database Backup

(Asked by: username_0 on 2018-04-27)

Why do I have to activate the PHP functions: "proc\_open" and "proc\_close" to backup the database?

I got the error logs:

> [error][yii\base\Exception] yii\base\Exception: Could not create backup: proc\_open() has been disabled for security reasons in /home/velolade/craft3veloladen\_daten/vendor/craftcms/cms/src/controllers/UtilitiesController.php:383
>
> [error][yii\base\Exception] yii\base\Exception: Could not create backup: proc\_close() has been disabled for security reasons in /home/velolade/craft3veloladen\_daten/vendor/craftcms/cms/src/controllers/UtilitiesController.php:383

After activating these functions in my hoster's PHP settings, it worked.
Is this a security problem for my website?

Thank you very much!

**Tags:** craft3, database, security, back-up

---

## 1 answers

### Answer by username_1 on 2018-04-30. Score: 2 | Accepted answer

Craft uses MySQL's native [mysqldump](https://dev.mysql.com/doc/refman/8.0/en/mysqldump.html) and PostgreSQL's [pg\_dump](https://www.postgresql.org/docs/10/static/app-pgdump.html) binaries to create database backups.

In order for PHP to be able to execute those binaries, it needs to be able to run the `proc_open` and `proc_close` PHP commands.

I would not consider it a security issue, but if you were really concerned about it, you can [prevent Craft from making backups on update](https://docs.craftcms.com/api/v3/craft-config-generalconfig.html#$backupOnUpdate-detail) and/or specify your own [backup logic](https://docs.craftcms.com/api/v3/craft-config-generalconfig.html#$backupCommand-detail) bypassing Craft's default implementation.

> **Comments:**
> **username_2**: How did Craft 2 do it? Craft 2 worked flawlessly with openbasedir, Craft 3 does not.  
> **username_1**: Not sure what this post has to do with openbasedir?  
> **username_2**: openbasedir disables proc_open(), no? That seems to be how shared hosting typically works in any case.  
> **username_1**: Ahh, a host that might use openbase_dir, might also happen to disable some proc_ methods, but they are technically unrelated.  

---

