1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
|
<?xml version="1.0" encoding="utf-8"?>
<reference id="ref.exec">
<title>Program Execution functions</title>
<titleabbrev>Program Execution</titleabbrev>
<refentry id="function.escapeshellarg">
<refnamediv>
<refname>escapeshellarg</refname>
<refpurpose>escape a string to be used as a shell argument</refpurpose>
</refnamediv>
<refsect1>
<title>Description</title>
<methodsynopsis>
<type>string</type><methodname>escapeshellarg</methodname>
<methodparam><type>string</type><parameter>arg</parameter></methodparam>
</methodsynopsis>
<para>
<function>EscapeShellArg</function> adds single quotes around a string
and quotes/escapes any existing single quotes allowing you to pass a
string directly to a shell function and having it be treated as a single
safe argument. This function should be used to escape individual
arguments to shell functions coming from user input. The shell functions
include <function>exec</function>, <function>system</function> and the
<link linkend="language.operators.execution">backtick operator</link>.
A standard use would be:</para>
<para>
<informalexample>
<programlisting role="php">
system("ls ".EscapeShellArg($dir))
</programlisting>
</informalexample>
</para>
<para>
See also <function>exec</function>, <function>popen</function>,
<function>system</function>, and the <link
linkend="language.operators.execution">backtick operator</link>.
</para>
</refsect1>
</refentry>
<refentry id="function.escapeshellcmd">
<refnamediv>
<refname>escapeshellcmd</refname>
<refpurpose>escape shell metacharacters</refpurpose>
</refnamediv>
<refsect1>
<title>Description</title>
<methodsynopsis>
<type>string</type><methodname>escapeshellcmd</methodname>
<methodparam><type>string</type><parameter>command</parameter></methodparam>
</methodsynopsis>
<para>
<function>EscapeShellCmd</function> escapes any characters in a
string that might be used to trick a shell command into executing
arbitrary commands. This function should be used to make sure
that any data coming from user input is escaped before this data
is passed to the <function>exec</function> or
<function>system</function> functions, or to the <link
linkend="language.operators.execution">backtick
operator</link>. A standard use would be:</para>
<para>
<informalexample>
<programlisting role="php">
$e = EscapeShellCmd($userinput);
system("echo $e"); // here we don't care if $e has spaces
$f = EscapeShellCmd($filename);
system("touch \"/tmp/$f\"; ls -l \"/tmp/$f\""); // and here we do, so we use quotes
</programlisting>
</informalexample>
</para>
<para>
See also <function>escapeshellarg</function>, <function>exec</function>,
<function>popen</function>, <function>system</function>, and the <link
linkend="language.operators.execution">backtick operator</link>.
</para>
</refsect1>
</refentry>
<refentry id="function.exec">
<refnamediv>
<refname>exec</refname>
<refpurpose>Execute an external program</refpurpose>
</refnamediv>
<refsect1>
<title>Description</title>
<methodsynopsis>
<type>string</type><methodname>exec</methodname>
<methodparam><type>string</type><parameter>command</parameter></methodparam>
<methodparam choice="opt"><type>string</type><parameter>array
</parameter></methodparam>
<methodparam choice="opt"><type>int</type><parameter>return_var</parameter></methodparam>
</methodsynopsis>
<para>
<function>exec</function> executes the given
<parameter>command</parameter>, however it does not output
anything. It simply returns the last line from the result of the
command. If you need to execute a command and have all the data
from the command passed directly back without any interference,
use the <function>PassThru</function> function.
</para>
<para>
If the <parameter>array</parameter> argument is present, then the
specified array will be filled with every line of output from the
command. Note that if the array already contains some elements,
<function>exec</function> will append to the end of the array.
If you do not want the function to append elements, call
<function>unset</function> on the array before passing it to
<function>exec</function>.
</para>
<para>
If the <parameter>return_var</parameter> argument is present
along with the <parameter>array</parameter> argument, then the
return status of the executed command will be written to this
variable.
</para>
<para>
Note that if you are going to allow data coming from user input
to be passed to this function, then you should be using
<function>EscapeShellCmd</function> to make sure that users
cannot trick the system into executing arbitrary commands.
</para>
<para>
Note also that if you start a program using this function and
want to leave it running in the background, you have to make
sure that the output of that program is redirected to a file or
some other output stream or else PHP will hang until the
execution of the program ends.
</para>
<para>
See also <function>system</function>,
<function>PassThru</function>, <function>popen</function>,
<function>EscapeShellCmd</function>, and the <link
linkend="language.operators.execution">backtick operator</link>.
</para>
</refsect1>
</refentry>
<refentry id="function.passthru">
<refnamediv>
<refname>passthru</refname>
<refpurpose>
Execute an external program and display raw output
</refpurpose>
</refnamediv>
<refsect1>
<title>Description</title>
<methodsynopsis>
<type>void</type><methodname>passthru</methodname>
<methodparam><type>string</type><parameter>command</parameter></methodparam>
<methodparam choice="opt"><type>int</type><parameter>return_var</parameter></methodparam>
</methodsynopsis>
<para>
The <function>passthru</function> function is similar to the
<function>exec</function> function in that it executes a
<parameter>command</parameter>. If the
<parameter>return_var</parameter> argument is present, the return
status of the Unix command will be placed here. This function
should be used in place of <function>exec</function> or
<function>system</function> when the output from the Unix command
is binary data which needs to be passed directly back to the
browser. A common use for this is to execute something like the
pbmplus utilities that can output an image stream directly. By
setting the content-type to <emphasis>image/gif</emphasis> and
then calling a pbmplus program to output a gif, you can create
PHP scripts that output images directly.</para>
<para>
Note that if you start a program using this function and want to
leave it running in the background, you have to make sure that the
output of that program is redirected to a file or some other
output stream or else PHP will hang until the execution of the
program ends.
</para>
<para>
See also <function>exec</function>, <function>system</function>,
<function>popen</function>, <function>EscapeShellCmd</function>,
and the <link linkend="language.operators.execution">backtick
operator</link>.
</para>
</refsect1>
</refentry>
<refentry id="function.system">
<refnamediv>
<refname>system</refname>
<refpurpose>Execute an external program and display output</refpurpose>
</refnamediv>
<refsect1>
<title>Description</title>
<methodsynopsis>
<type>string</type><methodname>system</methodname>
<methodparam><type>string</type><parameter>command</parameter></methodparam>
<methodparam choice="opt"><type>int</type><parameter>return_var</parameter></methodparam>
</methodsynopsis>
<para>
<function>system</function> is just like the C version of the
function in that it executes the given
<parameter>command</parameter> and outputs the result. If a
variable is provided as the second argument, then the return
status code of the executed command will be written to this
variable.
</para>
<para>
Note, that if you are going to allow data coming from user input
to be passed to this function, then you should be using the
<function>EscapeShellCmd</function> function to make sure that
users cannot trick the system into executing arbitrary
commands.
</para>
<para>
Note also that if you start a program using this function and want
to leave it running in the background, you have to make sure that
the output of that program is redirected to a file or some other
output stream or else PHP will hang until the execution of the
program ends.
</para>
<para>
The <function>system</function> call also tries to automatically
flush the web server's output buffer after each line of output if
PHP is running as a server module.
</para>
<para>
Returns the last line of the command output on success, and &false;
on failure.
</para>
<para>
If you need to execute a command and have all the data from the
command passed directly back without any interference, use the
<function>PassThru</function> function.
</para>
<para>
See also <function>exec</function>,
<function>PassThru</function>, <function>popen</function>,
<function>EscapeShellCmd</function>, and the <link
linkend="language.operators.execution">backtick operator</link>.
</para>
</refsect1>
</refentry>
</reference>
<!-- Keep this comment at the end of the file
Local variables:
mode: sgml
sgml-omittag:t
sgml-shorttag:t
sgml-minimize-attributes:nil
sgml-always-quote-attributes:t
sgml-indent-step:1
sgml-indent-data:t
indent-tabs-mode:nil
sgml-parent-document:nil
sgml-default-dtd-file:"../../manual.ced"
sgml-exposed-tags:nil
sgml-local-catalogs:nil
sgml-local-ecat-files:nil
End:
-->
|
