Safe run shell scripts; avoid vars until execution
Suppose that we have a simple php script, which should get ssh_host
, ssh_username
, ssh_port
of the $ _GET array and try to connect using these parameters to SSH.
$port = escapeshellcmd($_GET['ssh_port']);
$host = escapeshellcmd($_GET['ssh_host']);
$username = escapeshellcmd($_GET['ssh_username']);
$answer = shell_exec("ssh -p " . $port . " " . $user . "@" . $host);
Is it escapeshellcmd()
enough or do I need something more complex? Or maybe I should use escapeshellarg()
in this example?
Thanks.
source to share
I would say that this is what was created - so as to avoid the parameters you should be using. escapeshellarg
Basically:
- To avoid one parameter use
escapeshellarg
- To avoid the command altogether, use
escapeshellcmd
.
Denoting the relevant documentation:
escapeshellcmd ():
This function should be used to ensure that any data coming from user input is escaped before that data is passed to functions exec()
or system()
or to the loopback operator.
escapeshellarg ():
This function should be used to remove individual arguments for shell functions coming from user input.
source to share