disable_functions=exec, passthru, shell_exec, system, proc_open, popen, pcntl_exec, ftp_exec, fopen, fgets, curl_exec, curl_multi_exec, escapeshellarg, escapeshellcmd

This was people are allowed to upload, even use includes... but as far as web based shells go its a moot point.