★ wanayoo — archive 1999 http://www.php.net/manual/function.escapeshellcmd.php

	Program Execution
		escapeshellcmd
		exec
		passthru
		system

Manual: escapeshellcmd

Program Execution

exec

escapeshellcmd

(PHP3 , PHP4 )

escapeshellcmd -- escape shell metacharacters

Description

string escapeshellcmd (string command)

EscapeShellCmd() escapes any characters in a string that might be used to trick a shell command into executing arbitrary commands. This function should be used to make sure that any data coming from user input is escaped before this data is passed to the exec() or system() functions, or to the backtick operator. A standard use would be:

  1 
  2 system(EscapeShellCmd($cmd))
  3

See also exec(), popen(), system(), and the backtick operator.

User Contributed Notes: escapeshellcmd

johannes@scram.de
07-Jul-1999 10:40

I found this function very useful for checking variables which are included in SQL query strings.

jawarren@trentu.ca
07-Jul-1999 06:56

Well then obviously if this has other uses we need a little more information about what it's doing. Perhaps the function should be extended to allow customisation for SQL or exec() as they would seem to require different things escaped and escaped in different ways. Out of every typable key on a US-101 keyboard, here are the characters that were prefixed with a '\' by EscapeShellCmd(): ~`$^&*()[{}]\|;'"<>? Considering this doesn't contain either of the SQL wildcards ('%', '_') I'm not sure how useful it is for that.

nemo
03-Aug-1999 06:12

You may or may not consider this a feature: <p> <code>escapeshellcmd</code> does <b>not</b> escape the shell comment character ('<code>#</code>'). You have to do this yourself.

php@squish.net
17-Dec-1999 05:58

This function is almost always a waste of time. Normally you know what program you want to run and you want to change the parameters to it based on user input. For example: $cmd = '/usr/local/bin/myprog --param1="'.$input."'"; This $input must be quoted, but NOT by escapeshellcmd, but by a function that is sadly missing from PHP (surprise, surprise) - one that escapes ONLY double-quote, backslash and back-tick. You will have to write this yourself. If you use escapeshellcmd things like & and ' will be quoted and you will get extra \s sent to your program.

php@squish.net
17-Dec-1999 06:20

Or alternatively use single quotes and use:

function escape($text) {
  return ereg_replace("'", "\\'", $text);
}

php@squish.net
17-Dec-1999 07:12

Sigh, I of course meant:

function escape($text) {
  return ereg_replace("'", "'\\''", $text);
}

nwaltham@yahoo.com
11-May-2000 07:37

Does that alternative system you state here actually stop someone doing a pipe by supplying the pipe system in the user input?

Program Execution

exec

Site
Hosting:

Located in
United States

Elements of this website are subject to copyright.
Questions about installing or using PHP should be directed to one of the mailing lists.
Only questions about the website should be directed to webmaster@php.net.