Doc #60116 [ReO->Fbk]: escapeshellcmd() cannot escape the chars which causes shell injection.

Edit report at https://bugs.php.net/bug.php?id=60116&edit=1 ID: 60116 Updated by: hirokawa@php.net Reported by: hirokawa@php.net Summary: escapeshellcmd() cannot escape the chars which causes shell injection. -Status: Re-Opened +Status: Feedback Type: Documentation Problem Package: Filter related Operating System: Ubuntu Linux PHP Version: trunk-SVN-2011-10-23 (SVN) -Assigned To: hirokawa +Assigned To: lbarnaud Block user comment: N Private report: N New Comment: >the documentation should be updated (removing the flawed example, and >emphasizing the correct usage). Please do by yourself if you have the karma for phpdoc. (I already removed the sentence which I added for the patch.) If you don't have the karma, I will update the document. And, you need to show a typical example of escapeshellcmd() instead of the 'flawed' example you mentioned. Previous Comments: ------------------------------------------------------------------------ [2011-11-11 15:19:51] tyrael@php.net the documentation should be updated (removing the flawed example, and emphasizing the correct usage). ------------------------------------------------------------------------ [2011-11-11 15:06:10] hirokawa@php.net Thank you for taking the time to write to us, but this is not a bug. Please double-check the documentation available at http://www.php.net/manual/ and the instructions on how to report a bug at http://bugs.php.net/how-to-report.php ------------------------------------------------------------------------ [2011-11-11 14:52:48] hirokawa@php.net Automatic comment from SVN on behalf of hirokawa Revision: http://svn.php.net/viewvc/?view=revision&amp;revision=319057 Log: revert changes to fix bug #60116. ------------------------------------------------------------------------ [2011-11-11 09:53:49] lbarnaud@php.net > The default behavier which not escaped paired quotes is still dangerous even if the > single-quotes is used. Yes, I was speaking of both single quotes and double quote: Don't enclose the escaped string in quotes at all :) This is a bit puzzling because all escaping function like mysql_escape_string expect the user to enclose the string in quotes. But escapeshellcmd and escapeshellarg don't. It's like htmlspecialchars: it just removes the special meaning of special characters. > But, generally, escapeshellcmd() is used to escape the user input It shouldn't be the case. escapeshellcmd escapes all control characters from a string, which avoids command injection, redirection, etc but doesn't prevent argument injection (it doesn't escape spaces). ------------------------------------------------------------------------ [2011-11-10 22:49:42] hirokawa@php.net The default behavier which not escaped paired quotes is still dangerous even if the single-quotes is used. $_GET['key'] = ":' '/etc/hosts"; $key = escapeshellcmd($_GET['key']); $cmd = "grep '$key' /var/data/*"; // <- single quote system($cmd); // output: grep ':' '/etc/hosts' /var/data/* You are right, escapeshellarg() is better than escapeshellcmd() in this case. But, generally, escapeshellcmd() is used to escape the user input (GET/POST/Cookie), the default behavior (paired quotes are not escaped) is not recommended. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=60116 -- Edit this bug report at https://bugs.php.net/bug.php?id=60116&edit=1