phpstudy linux web面板(docker) 十一假期后上线,敬请期待

escapeshellcmd

escapeshellcmd

(PHP 4, PHP 5)

escapeshellcmdEscape shell metacharacters

说明

string escapeshellcmd ( string $command )

escapeshellcmd() escapes any characters in a string that might be used to trick a shell command into executing arbitrary commands. This function should be used to make sure that any data coming from user input is escaped before this data is passed to the exec() or system() functions, or to the backtick operator.

Following characters are preceded by a backslash: #&;`|*?~<>^()[]{}$, x0A and xFF. ' and " are escaped only if they are not paired. In Windows, all these characters plus % are replaced by a space instead.

参数

command

The command that will be escaped.

返回值

The escaped string.

范例

Example #1 escapeshellcmd() example

<?php
// We allow arbitrary number of arguments intentionaly here.
$command './configure '.$_POST['configure_options'];

$escaped_command escapeshellcmd($command);
 
system($escaped_command);
?>

Warning

escapeshellcmd() should be used on the whole command string, and it still allows the attacker to pass arbitrary number of arguments. For escaping a single argument escapeshellarg() should be used instead.

参见


  • escapeshellarg
  • escapeshellcmd
  • exec
  • passthru
  • proc_close
  • proc_get_status
  • proc_nice
  • proc_open
  • proc_terminate
  • shell_exec
  • system
  • PHP MySQL HTML CSS JavaScript MSSQL AJAX .NET JSP Linux Mac ASP 服务器 SQL jQuery C# C++ java Android IOS oracle MongoDB SQLite wamp 交通频道

    无数据提示还没有评论,楼主喊你快去抢前排~~~我要评论
    微信扫码登陆

    打开 微信
    扫一扫登录