PHP Security-Command injection

Command injection

Using system commands is a risky operation, especially if you are trying to use remote data to construct a command to execute. If the contaminated data is used, the command injection vulnerability is generated.

Exec () is a function for executing shell commands. It returns execution and returns the last line of the command output, but you can specify an array as the second parameter so that each line of the output is stored as an element in the array. Use the following methods:

  <?php   $last = exec (' ls ', $output, $return);   Print_r ($output);  echo "Return [$return]";   ? >

Assuming that the LS command is run manually in the shell, it produces the following output:

$ ls Total  0  -rw-rw-r--  1 Chris Chris 0 12:34php-security  -rw-rw-r--  1 Chris Chris 0 May 21 12: 34chris-shiflett

When running in exec () using the method of the previous example, the output is as follows:

Array  (      [0] = total 0      [1] =-rw-rw-r--  1 Chris Chris 0 may 2112:34 php-security      [2] =- rw-rw-r--  1 Chris Chris 0 may 2112:34 Chris-shiflett  )  Return [0]

This method of running the shell command is convenient and useful, but this convenience poses a significant risk to you. If the contaminated data is used to construct the command string, the attacker can execute arbitrary commands.

I suggest that you avoid using shell commands if you can, and if you do, make sure that the data that constructs the command string is filtered and that the output must be escaped:

<?php   $clean = Array ();  $shell = Array ();   /* Filter Input ($command, $argument) */   $shell [' Command '] =escapeshellcmd ($clean [' Command ']);  $shell [' argument '] =escapeshellarg ($clean [' argument ']);   $last = Exec ("{$shell [' command ']}{$shell [' Argument ']}", $output, $return);   >

Although there are several ways to execute a shell command, it is important to insist that only filtered and escaped data is allowed when constructing a running string. Other similar functions that need attention are passthru (), Popen (), Shell_exec (), and System (). I reiterate once again that it is advisable to avoid the use of all shell commands if possible.

The above is the PHP Security-command injection content, more relevant content please pay attention to topic.alibabacloud.com (www.php.cn)!

