Simple analysis of PHP system program execution functions (system, passthru, exec) (with code)

This article introduces to you a simple analysis of the PHP system program execution functions (system, passthru, exec) (with code). It has certain reference value. Friends in need can refer to it. I hope it will be helpful to you. helped.

exec — Execute an external program

string exec ( string $command [, array &$output [, int &$return_var ]] )

Example

<?php
        echo exec("ls",$output);
        echo "</br>";
        print_r($file);
?>

Execution result:

test.php
Array([0] => index.php [1] => test.php)

Analysis:
exec will not actively return the execution result, and only returns the last line of the result;
If you want to obtain the complete result, you need a second parameter to output it to the specified array. This One record in the array represents a line of output, and when different system external commands are repeatedly executed, the unset() array is cleared when outputting the results of each system external command to prevent confusion;
The third parameter is used to obtain command execution The status code usually returns 0 if the execution is successful.

passthru — Execute an external program and display the raw output

void passthru ( string $command [, int &$return_var ] )

Example

<?php
        passthru("ls");
?>

Execution result:

index.phptest.php

Analysis:
Similar to the exec() function, it is also used to execute external commands, but directly The result is output to the browser (raw output without any processing), with no return value;
Use this function when binary data needs to be output and needs to be sent directly to the browser, such as directly outputting the image stream. Command;

system — Execute an external program and display the output

string system ( string $command [, int &$return_var ] )

<?php
        system(&#39;ls&#39;, $retval);
?>

Analysis:
Output the results directly to the browser;
The second parameter is the return status after the external command is executed;
If successful, the last line of the command output will be returned, if failed, FALSE will be returned;
If PHP runs in the server module, and the system() function also attempts to automatically refresh the web server's output cache after each line of output.

shell_exec — Execute the command through the shell environment and return the complete output as a string.

Description
string shell_exec (string $cmd)
The backtick operator "`" has the same effect as the function shell_exec().
Return value of shell_exec
When an error occurs during process execution, or the process does not produce output, NULL will be returned. Therefore, using this function cannot detect whether the process is successfully executed through the return value. If you need to check the exit code of a process execution, use the exec() function.

Example

<?php
$output = `ls -al`;
echo "<pre class="brush:php;toolbar:false">$output

Note:
The backtick operator has no effect when safe mode is activated or shell_exec() is turned off.
Unlike some other languages, backticks cannot be used in double-quoted strings.

Example #1 shell_exec() routine
This function cannot be used when PHP is running in safe mode.

<?php
$output = shell_exec(&#39;ls -lart&#39;);
echo "<pre class="brush:php;toolbar:false">$output

escapeshellarg
Description
string escapeshellarg (string $arg)
escapeshellarg() will add a single quote to the string and can quote or escape any existing The existence of single quotes ensures that a string can be passed directly into the shell function and is still safe. This function should be used for some parameters entered by the user. Shell functions include exec(), system() execution operators.

Parameters
arg
Parameters that need to be transcoded.

Return value
String after conversion.

Example

<?php
system(&#39;ls &#39;.escapeshellarg($dir));
?>

escapeshellcmd
Description
string escapeshellcmd (string $command)
escapeshellcmd() may spoof shell commands in strings Escape characters that execute arbitrary commands. This function ensures that user-entered data is escaped before being passed to the exec() or system() function, or execution operator.

Backslash (\) is inserted before the following characters: `|*?~a8093152e673feb7aba1828c43532094^()[]{}$\, \x0A and \xFF. ' and " are escaped only when unmatched. On Windows platforms, all these characters, as well as the % and ! characters, are replaced by spaces.
Parameters
command
The command to escape.

Return value
The escaped string.

Example

<?php
// 我们故意允许任意数量的参数
$command = &#39;./configure &#39;.$_POST[&#39;configure_options&#39;];
$escaped_command = escapeshellcmd($command);
 
system($escaped_command);
?>

Warning
escapeshellcmd() should be used on the complete command string. Even if In this way, the attacker can still pass in any number of parameters. Please use the escapeshellarg() function to escape a single parameter.

Recommended related articles:

_get method in php and _set method access method example code

Summary of various ways of operating files in php (with code)

The above is the detailed content of Simple analysis of PHP system program execution functions (system, passthru, exec) (with code). For more information, please follow other related articles on the PHP Chinese website!