note 58680 deleted from function.escapeshellarg by daverandom
| From: | daverandom@php.net | Date: | Sun, 24 Mar 2019 02:26:05 +0000 |
| Subject: | note 58680 deleted from function.escapeshellarg by daverandom | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-210434@lists.php.net to get a copy of this message | ||
Note Submitter: phpnet at lostreality dot org
----
This function does not escape $ it seems. This lets user embed shell variables such as $PATH into
commands, which you may or may not want to allow. I'm using shell_exec() because I need the
entire command as one string, and need access to the stdout data as one string as well.