Safe executing shell scripts; escaping vars before execution.
Posted
by Kirzilla
on Stack Overflow
See other posts from Stack Overflow
or by Kirzilla
Published on 2010-04-12T19:03:43Z
Indexed on
2010/04/12
19:13 UTC
Read the original article
Hit count: 291
Hello,
Let's imagine that we have a simple php script that should get ssh_host, ssh_username, ssh_port from $_GET array and try to connect using this parameters to SSH.
$port = escapeshellcmd($_GET['ssh_port']);
$host = escapeshellcmd($_GET['ssh_host']);
$username = escapeshellcmd($_GET['ssh_username']);
$answer = shell_exec("ssh -p " . $port . " " . $user . "@" . $host);
Is escapeshellcmd() enough or I need something more tricky?
Or maybe I should use escapeshellarg() in this example?
Thank you.
© Stack Overflow or respective owner
