The php Function Ini_Restore
The php function ini_restore restores a configuration option variable to its original value. This happens automatically when a script completes execution for configuration options set using ini_set() during that script.
In PHP, a validator can be attached to the ini_restore function. This validator is notified of the new INI setting value, and must validate it (for example, to ensure that the long-valued option actually is a positive integer). If successful, the value is added to the existing global INI setting. Otherwise, a FAILURE is returned.
For this to work, the INI_DEFAULT value is set to a constant that you provide, and then the engine reads the value from a zend_ini_entry_def that you register with the engine. This means that the INI_DEFAULT value can't change during a request, and when the request ends, the engine restores the original setting to its default value.
This feature is very helpful for preventing attacks that target the INI file, since attackers are more likely to focus on trying to hijack ini_restore than they are to try to use ini_set or ini_get to alter INI settings in malicious ways. In addition, registering the INI_DEFAULT in this manner helps narrow down a search of tens-of-thousands of PHP files to a relatively small set of potential candidates for attack. This is a significant advantage over other methods of INI security.