exec, single quote & security...

[Shagshag]

Hello,

(i'm particulary interested in security issue - php is running on
apache + linux)

i need to pass the result (here $exp) of a form submission to a third
part application using :

exec("echo $exp | third_part", $arr, $ret);

this $exp may contain simple quote such as in "they're" and if i'm
very unlucky harmful code for my system.

by now i use :

$exp = "'" . implode("' \' '", explode("'", stripslashes($exp))) .
"'";

to be sure to maintain single quotes and i also expect to avoid some
common vulnerabilities (by enclosing them inside '')

how can i be sure that $exp isn't harmful ? is is enough ?

thanks,

[Luke Ross]

Hi,

Shagshag wrote:

>
> (i'm particulary interested in security issue - php is running on
> apache + linux)
>
> i need to pass the result (here $exp) of a form submission to a third
> part application using :
>
> exec("echo $exp | third_part", $arr, $ret);
>
> this $exp may contain simple quote such as in "they're" and if i'm
> very unlucky harmful code for my system.
>
> by now i use :
>
> $exp = "'" . implode("' \' '", explode("'", stripslashes($exp))) .
> "'";
>
> to be sure to maintain single quotes and i also expect to avoid some
> common vulnerabilities (by enclosing them inside '')
>
> how can i be sure that $exp isn't harmful ? is is enough ?

There's a special built in function for this. See:

[url]http://uk2.php.net/manual/en/function.escapeshellarg.php[/url]

Regards,

Luke