If a phpinfo()
dump is shown to an end user, what is the worst that a malicious user could do with that information? What fields are most unsecure? That is, if
A well-configured, up-to-date system can afford to expose phpinfo()
without risk.
Still, it is possible to get hold of so much detailed information - especially module versions, which could make a cracker's life easier when newly-discovered exploits come up - that I think it's good practice not to leave them up. Especially on shared hosting, where you have no influence on everyday server administration.