note 53729 added to function.shell-exec

THE FUNCTION POSTED BY "Jan dot besssai at gmx dot de" IS INCREDIBLY UNSAFE AND SHOULD NEVER BE USED... HIS POST STARTS WITH "Here is a safe way to create .htpasswd files for .htaccess"... Try this: execute the script with an url something like: http://hostname/scriptname.php?name=a%20b%3Brm%20-rf%20%2f and you've just deleted EVERY !@!@ FILE writable by whatever user that executes the script - typically the webserver! (I did not test the script, but it wouldn't be hard to make it work) Since $nam is treated as a literal, unchecked string and is passed directly to a shell command, YOU WOULD END UP EXECUTINIG A COMMAND LIKE: htpasswd -n -b -m a b; rm -rf / THIS IS TERRIBLE! Always always ALWAYS CHECK YOUR INPUT and use escapeshellarg() for good measure! NO EXCEPTIONS! I'm simply amazed that this post has existed for over a year and is still posted here! ---- Manual Page -- http://www.php.net/manual/en/function.shell-exec.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+53729 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+53729&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+53729&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+53729&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+53729&report=yes&reason=useless Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+53729&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+53729&report=yes Search -- http://master.php.net/manage/user-notes.php