PHP uses the EXEC shell command injection method to explain the _php tutorial

Using system commands is a risky operation, especially if you are trying to use remote data to construct a command to execute. If the contaminated data is used, the command injection vulnerability is generated.
EXEC () is a function for executing shell commands. It returns execution and returns the last line of the command output, but you can specify an array as the second parameter so that each line of the output is stored as an element in the array. Use the following methods:
Copy CodeThe code is as follows:
$last = exec (' ls ', $output, $return);
Print_r ($output);
echo "Return [$return]";
?>

Assuming that the LS command is run manually in the shell, it produces the following output:
Copy CodeThe code is as follows:
$ ls
Total 0
-rw-rw-r--1 Chris Chris 0 12:34 Php-security
-rw-rw-r--1 Chris Chris 0 12:34 Chris-shiflett

When running in exec () using the method of the previous example, the output is as follows:
Copy CodeThe code is as follows:
Array
(
[0] = total 0
[1] =-rw-rw-r--1 Chris Chris 0 12:34 Php-security
[2] =-rw-rw-r--1 Chris Chris 0 12:34 Chris-shiflett
)
Return [0]

This method of running the shell command is convenient and useful, but this convenience poses a significant risk to you. If the contaminated data is used to construct the command string, the attacker can execute arbitrary commands.
I suggest that you avoid using shell commands if you can, and if you do, make sure that the data that constructs the command string is filtered and that the output must be escaped:
Copy CodeThe code is as follows:
$clean = Array ();
$shell = Array ();
/* Filter Input ($command, $argument) */
$shell [' command '] = Escapeshellcmd ($clean [' Command ']);
$shell [' argument '] = Escapeshellarg ($clean [' argument ']);
$last = Exec ("{$shell [' command '}} {$shell [' argument ']}", $output, $return);
?>

Although there are several ways to execute a shell command, it is important to insist that only filtered and escaped data is allowed when constructing a running string. Other similar functions that need attention are passthru (), Popen (), Shell_exec (), and System (). I reiterate once again that it is advisable to avoid the use of all shell commands if possible.

http://www.bkjia.com/PHPjc/825134.html www.bkjia.com true http://www.bkjia.com/PHPjc/825134.html techarticle using system commands is a risky operation, especially if you are trying to use remote data to construct a command to execute. If the contaminated data is used, the command injection vulnerability is produced ...

