Bug #18291 Updated: exec() arguments (+suggested solution)

ID: 18291 Updated by: sniper@php.net Reported By: php.hc@saustrup.net -Status: Open +Status: Bogus Bug Type: Program Execution Operating System: RedHat Linux 7.3 PHP Version: 4.1.2 New Comment: FYI: PHP uses popen(), not execve().. In 4.2.1 there is pcntl_exec() which behaves similarly to the system execve. Maybe that's what you want to use..? Try these scripts: shell_args_1arg.php: <?php echo exec('./test.sh "213 123"'); ?> shell_args_2arg.php: <?php echo exec('./test.sh 213 123'); ?> test.sh: <----8<----> #!/bin/sh echo $1 <----8<----> Previous Comments: ------------------------------------------------------------------------ [2002-07-12 08:31:07] php.hc@saustrup.net And just to make it perfectly clear what arguments my binary is getting: Arg1: 1 Arg2: 2 Arg3: 3 Arg4: "a Arg5: b Arg6: c" Arg7: 4 Arg8: 5 Arg9: 6 ------------------------------------------------------------------------ [2002-07-12 08:28:20] php.hc@saustrup.net As far as I can see, it's not even required by the exec()'ing user to have a valid shell in /etc/passwd, so I very much expect that the binary is being exec()'d directly, without the use of a shell. If you check out the man page for the execve() function, you'll see that arguments are actually submitted as an array, and not as a whole string. If they were infact passed through a shell (I believe the backticks and passthru() does this), escapeshellarg() might have been the solution - but not in this case. I tried it, but exec() apparently still splits up the string where it finds whitespaces (escaped or not), and passes it on to ie. execve(). And just to make it perfectly clear what I want: Binary: /usr/bin/binary Arg1: 1 Arg2: 2 Arg3: 3 Arg4: a b c Arg5: 4 Arg6: 5 Arg7: 6 ------------------------------------------------------------------------ [2002-07-12 00:21:28] sniper@php.net Not any bug. It's up to the external program how it handles the arguments you pass it..try same on the cmd line and you'll understand what I mean. To get "'s through, you need to escape them.. Check this out: http://www.php.net/manual/en/function.escapeshellarg.php exec() doesn't split anything, it passes what is given to it straight to the shell to be executed as is. ------------------------------------------------------------------------ [2002-07-11 22:44:08] php.hc@saustrup.net This kept me up all night :-) I needed to pass a textstring to an external program, and did something like this in PHP: exec('/usr/bin/binary 1 2 3 "a b c" 4 5 6'); It kept screwing up, and after debugging it I realized that the exec() function actually called /usr/bin/binary with 9 arguments, and not 7 as I thought it would. Apparently PHP's exec() just splits up the string where it finds whitespaces and thinks they're different arguments. I'm not sure about the proper solution, but it would be awesome with a more "strict" exec()-like function that could work something like this: newexec('/usr/bin/binary',array('1','2','3','a b c','4','5','6')); That way, there would be NO doubt about the arguments :-) ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=18291&edit=1