phpstudy所有软件,已经通过360安全检测认证,phpstudy linux web面板(docker),已发布安全检测与修复

escapeshellcmd

  • 477

escapeshellcmd

(PHP 4, PHP 5)

escapeshellcmdEscape shell metacharacters

说明

string escapeshellcmd ( string $command )

escapeshellcmd() escapes any characters in a string that might be used to trick a shell command into executing arbitrary commands. This function should be used to make sure that any data coming from user input is escaped before this data is passed to the exec() or system() functions, or to the backtick operator.

Following characters are preceded by a backslash: #&;`|*?~<>^()[]{}$, x0A and xFF. ' and " are escaped only if they are not paired. In Windows, all these characters plus % are replaced by a space instead.

参数

command

The command that will be escaped.

返回值

The escaped string.

范例

Example #1 escapeshellcmd() example

<?php
// We allow arbitrary number of arguments intentionaly here.
$command './configure '.$_POST['configure_options'];

$escaped_command escapeshellcmd($command);
 
system($escaped_command);
?>

Warning

escapeshellcmd() should be used on the whole command string, and it still allows the attacker to pass arbitrary number of arguments. For escaping a single argument escapeshellarg() should be used instead.

参见


  • escapeshellarg
  • escapeshellcmd
  • exec
  • passthru
  • proc_close
  • proc_get_status
  • proc_nice
  • proc_open
  • proc_terminate
  • shell_exec
  • system
  • PHP MySQL HTML CSS JavaScript MSSQL AJAX .NET JSP Linux Mac ASP 服务器 SQL jQuery C# C++ java Android IOS oracle MongoDB SQLite wamp 交通频道

    微信扫码登陆

    打开 微信
    扫一扫登录