Looking for more information on how to do PHP the right way? Check out PHP: The Right Way

PHPBuilder.com:
Mitigate the Security Risks of PHP System Command Execution
Jan 29, 2010 @ 10:47:19

PHPBuilder.com has a new article from Jason Gilmore on security in command-line applications posted today and what you can do to help protect your scripts from unwanted system command access.

In this tutorial, I'll show you how to securely execute a variety of system-based commands via a PHP script, demonstrating how to build web applications that can tightly integrate with both the operating system and third-party software.

He mentions the proper filtering of input strings (user input), how it can protect your and your application as well as a few examples of using the PHP execution functions (like exec or passthru) and how to apply the shell escaping commands (like escapeshellarg) as a first layer of security.

tagged: system command execution security escape filter

Link: