Re: safe_shell_exec extension for consideration

Stig Bakken wrote:

Hi Dave, In general, I think calling functions or settings "safe"-anything gives users false fuzzies, and should be avoided.

I'm not concerned with what it's named. I really just want the functionality to exist. If you wanted to steal from perl, name it system() and I'd be just as happy.

Wouldn't it make more sense to simply extend the existing shell_exec() function in PHP's standard extension to also accept an array parameter?

It's most important to me that I have a way to invoke an external program without involving a shell. The string vs. array issue is secondary and only came up after my first iteration of code was already complete and I began to use it. With that in mind, how would you propose that the shell_exec() extension work? If a string is passed, still invoke a shell to avoid breaking all the code that's already out there, but avoid the shell if an array is passed? I also considered extending the bypass_shell option to proc_open() to work on unix, but that thought took me back to the same -- I'd have to add my tokenizing routine back in and a bunch of existing code that already uses proc_open() would break. I'm willing to entertain all suggestions and I'll put some amount of effort into providing code to implement whatever the best solution may be. Thank you, Dave