RE: [PHP] escapeshellarg
| From: | Brad Fuller | Date: | Mon, 14 May 2007 17:46:13 +0000 |
| Subject: | RE: [PHP] escapeshellarg | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-254919@lists.php.net to get a copy of this message | ||
Mohamed CHAARI wrote:
> Hi all,
>
> I have to execute an external command, with an argument
> (filename or directory name) given by user input (via a
> form), ie something like this:
>
> exec('ls $_POST[...]')
>
> what do you think about using escapeshellarg() function in
> this case ?
> can I rely on it to have a secure solution ? or is there a risk ? ...
>
>
> thank you.
In addition to using escapeshellarg(), I would first determine if the input
file or directory exists before executing the command. This adds another
layer of protection.
<?php
// Example code
if(file_exists($_POST['file_or_dir_name'])) {
$command = "ls ".escapeshellarg($_POST['file_or_dir_name']);
exec($command);
} else {
echo "File/Directory does not exist!!";
}
?>
-B