PHP shell_exec INSERT MySQL

Question

I'm trying to insert some data into a table with shell_exec (on localhost).

Here's the code I'm using:

$shellExec = 'C:\wamp\bin\mysql\mysql5.1.36\bin\mysql -h localhost -u root mm_'.$acname.' INSERT INTO account (acct_name,start_date,active,name,address1,address2,postcode,telephone,website,email,vat_number,vat_amount,start_number,currency) VALUES("'.$company.'","'.$start_date.'","'.$active.'","'.$acname.'","'.$address1.'","'.$address2.'","'.$postcode.'","'.$telephone.'","'.$website.'","'.$email.'","'.$vat_number.'","'.$vat_amount.'","'.$start_number.'","'.$currency.'")';

shell_exec($shellExec);

Which runs as:

C:\wamp\bin\mysql\mysql5.1.36\bin\mysql -h localhost -u root mm_robdunne22 INSERT INTO account (acct_name,start_date,active,name,address1,address2,postcode,telephone,website,email,vat_number,vat_amount,start_number,currency) VALUES("sdfsdfy","10-05-2011","1","robdunne22","fsdfs","dfsd","sdf","3423423434sdfsdf","cvxcvdfg","gfgh55ydddd","sdfs","sdfgggaacc","1","pound")

On the command line.

This fails - on the command line if i run this it just displays the MySQL help information. I think the problem is that logging into MySQL and the INSERT statement should be separate. They work fine if I split them, however I'm not sure how to make this work - either split into two or as one shell command.

Properly quoting command line arguments in Windows is already a daunting task. What you want to do has a name: masochism. — Álvaro González
– Álvaro González, Commented May 10, 2011 at 15:53
Also, while we're at it, you should look at prepared statements, and check that $company etc are properly escaped. Finally, if you are on a shared server, you need to check that other users can't see the commands you execute using the task manager (I think that's what it's called; the windows equivalent of top). — Nicholas Wilson
– Nicholas Wilson, Commented May 10, 2011 at 15:53
Thanks for the replies @Álvaro G. Vicario was right. Didn't manage to get this working. — logic-unit
– logic-unit, Commented May 11, 2011 at 10:15

shellter · Accepted Answer · 2011-05-10 23:37:28Z

2

From the mySQL documentation, here is an example that looks to accomplish what you need.

mysql -u root -p --execute="SELECT User, Host FROM mysql.user"

I hope this helps.

answered May 10, 2011 at 23:37

shellter

37.6k7 gold badges87 silver badges96 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Timofey Stolbov · Accepted Answer · 2011-05-10 15:47:05Z

0

Try to quote 'INSERT INTO [...skipped...] '

answered May 10, 2011 at 15:47

Timofey Stolbov

4,6813 gold badges42 silver badges46 bronze badges

Collectives™ on Stack Overflow

PHP shell_exec INSERT MySQL

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related