В LightBoxAPI есть возможность внедрять php код в поле ответа – это позволяет динамически обрабатывать ответ, реализовывая различные сценарии. Присутствует ряд ограничений для использования кода, запрещено использовать циклы: for, foreach, while.

Так же есть список запрещенных функций: exec, expect_popen, passthru, system, shell_exec, popen, proc_open, pcntl_exec, pcntl_alarm, pcntl_exec, pcntl_fork, pcntl_get_last_error, pcntl_getpriority, pcntl_setpriority, pcntl_signal, pcntl_signal_dispatch, pcntl_sigprocmask, pcntl_sigtimedwait, pcntl_sigwaitinfo, pcntl_strerror, pcntl_wait, pcntl_waitpid, pcntl_wexitstatus, pcntl_wifcontinued, pcntl_wifexited, pcntl_wifsignaled, pcntl_wifstopped, pcntl_wstopsig, pcntl_wtermsig, phpinfo, posix_mkfifo, posix_getlogin, posix_ttyname, getenv, get_current_user, proc_get_status, get_cfg_var, disk_free_space, disk_total_space, diskfreespace, getcwd, getlastmo, getmygid, getmyinode, getmypid, getmyuid, eval, assert, preg_replace, create_function, include, include_once, require, require_once, ob_start, array_diff_uassoc, array_diff_ukey, array_filter, array_intersect_uassoc, array_intersect_ukey, array_map, array_reduce, array_udiff_assoc, array_udiff_uassoc, array_udiff, array_uintersect_assoc, array_uintersect_uassoc, array_uintersect, array_walk_recursive, array_walk, assert_options, uasort, uksort, usort, preg_replace_callback, spl_autoload_register, iterator_apply, call_user_func, call_user_func_array, register_shutdown_function, register_tick_function, set_error_handler, set_exception_handler, session_set_save_handler, sqlite_create_aggregate, sqlite_create_function, eval, assert, str_rot13, base64_decode, gzinflate, gzuncompress, preg_replace, chr, hexdec, decbin, bindec, ord, str_replace, substr, goto, unserialize, trim, rtrim, ltrim, explode, strchr, strstr, chunk_split, strtok, addcslashes, runkit_function_rename, rename_function, call_user_func_array, call_user_func, register_tick_function, register_shutdown_function, fopen, opendir, tmpfile, phpversion, posix_getpwuid, posix_getgrgid, posix_uname, php_uname, ini_get, ini_get_all, bzopen, gzopen, chgrp, chmod, chown, copy, file_put_contents, lchgrp, lchown, link, mkdir, move_uploaded_file, rename, rmdir, symlink, tempnam, touch, unlink, imagepng, imagewbmp, image2wbmp, imagejpeg, imagexbm, imagegif, imagegd, imagegd2, iptcembed, ftp_get, ftp_nb_get, file_exists, file_get_contents, file, fileatime, filectime, filegroup, fileinode, filemtime, fileowner, fileperms, filesize, filetype, glob, is_dir, is_executable, is_file, is_link, is_readable, is_uploaded_file, is_writable, is_writeable, linkinfo, lstat, parse_ini_file, pathinfo, readfile, readlink, realpath, stat, gzfile, readgzfile, getimagesize, imagecreatefromgif, imagecreatefromjpeg, imagecreatefrompng, imagecreatefromwbmp, imagecreatefromxbm, imagecreatefromxpm, ftp_put, ftp_nb_put, exif_read_data, read_exif_data, exif_thumbnail, exif_imagetype, hash_file, hash_hmac_file, hash_update_file, md5_file, sha1_file, highlight_file, show_source, php_strip_whitespace, get_meta_tags, extract, parse_str, putenv, ini_set, mail, header, proc_nice, proc_terminate, proc_close, pfsockopen, fsockopen, apache_child_terminate, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid, debug_, dump, var_dump.

Ниже приведены примеры внедрения.