PHP System program execution function (system,passthru,exec) simple analysis (with code)

This article introduces to you about the PHP System program execution function (system,passthru,exec) simple analysis (with code), there is a certain reference value, the need for friends can refer to, I hope to help you.

EXEC -executes an external program

String exec (string $command [, Array & $output [, int & $return _var]])

Example

<?php        echo exec ("ls", $output);        echo "</br>";        Print_r ($file);? >

Execution Result:

test.php
Array ([0] = index.php [1] = test.php)

Analysis:
exec does not actively return execution results, and only returns the last line of the result;
To get the complete result, a second parameter is required to output it to the specified array, a record representing the output line, and repeated execution of different system external commands to clean up the unset () array when outputting the result of each system external command to prevent confusion;
The third parameter is used to get the status code for the execution of the command, and usually the success is returned 0.

PassThru -Executes an external program and displays the original output

void PassThru (String $command [, int & $return _var])

Example

<?php        passthru ("ls");? >

Execution Result:

index.phptest.php

Analysis:
Similar to the EXEC () function, it is also used to execute external commands, but outputs the result directly to the browser (without any processing of the original output), with no return value;
When you need to output binary data, and need to transfer directly to the browser, to use this function, such as: Direct output image stream command;

System -executes an external program and displays the output

String System (String $command [, int & $return _var])

<?php        system (' ls ', $retval);? >

Analysis:
Output the results directly to the browser;
The second parameter is the return state after the execution of the external command;
Success returns the last line of the command output, and the failure returns FALSE;
If PHP is running in a server module, the system () function will also attempt to automatically refresh the output cache of the Web server after each line has finished outputting.

Shell_exec -Executes the command through the shell environment and returns the full output as a string.

Description
String Shell_exec (String $cmd)
The inverse quote operator "'" has the same effect as the function shell_exec ().
return value of Shell_exec
When an error occurs during process execution, or if the process does not produce output, NULL is returned, so using this function cannot detect whether the process executed successfully by the return value. If you need to check the exit codes for process execution, use the EXEC () function.

Example

<?php$output = ' ls-al '; echo "<pre> $output </pre>";? >

Attention:
The anti-quote operator is not valid when Safe mode is activated or shell_exec () is turned off.
Unlike some other languages, anti-quotes cannot be used in double-quoted strings.

Example #1 shell_exec () routines
This function cannot be used when PHP is running in safe mode.

<?php$output = shell_exec (' Ls-lart '); echo "<pre> $output </pre>";? >

Escapeshellarg
Description
String Escapeshellarg (String $arg)
Escapeshellarg () adds a single quotation mark to the string and can reference or transcode any existing single quotes, ensuring that a string is passed directly to the shell function and is safe. This function should be used for some parameters entered by the user. The Shell function contains the EXEC (), System () execution operator.

Parameters
Arg
Parameters that need to be transcoded.

return value
The string after the conversion.

Example

<?phpsystem (' ls '. Escapeshellarg ($dir));? >

Escapeshellcmd
Description
String Escapeshellcmd (String $command)
Escapeshellcmd () escapes characters in a string that might spoof a shell command to execute arbitrary commands. This function guarantees that the data entered by the user is escaped before being transferred to the exec () or system () function, or before the operator is executed.

The backslash (\) is inserted before the following characters: &#; ' |*?~<>^ () []{}$\, \x0a and \xff. ' and ' are escaped only when they are not worthy of the child. On the Windows platform, all these characters as well as% and! Characters will be replaced by spaces.
Parameters
Command
The command to escape.

return value
The escaped string.

Example

<?php//We deliberately allow any number of parameters $command = './configure '. $_post[' configure_options ']; $escaped _command = Escapeshellcmd ($ command); System ($escaped _command);? >

Warning
Escapeshellcmd () should be used on the full command string. Even so, an attacker could pass in any number of arguments. Please use the Escapeshellarg () function to escape a single parameter.