0

I want to execute a PHP code from VS.code on Debian OS. I'm sure the Apache is installed and active. I'm sure the PHP is installed. I'm sure about the php.executepath is correct.

when I navigate to locallhost/ping.php the web page is loading but when I want to enter the IP and ping it there isn't any result on the page!

this is my code:

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>ping</title>
</head>
<body>
    <?php
       if(isset($_GET['ip'])) 
       {
        $ip = trim($_GET['ipp']);
        $cmd = "ping {$ip} -c 2";
        print '<pre>'.shell_exec(($cmd)).'<pre>';
       }
    ?>
    <form>
        IP : <input type="text" name="ip">
        <input type="submit" value="Ping">
    </form>
</body>
</html>
Improve this question
0

3 Answers 3

Reset to default
1

Create a script and insert the following:

Example phpinfo.php:

<?php phpinfo(); ?>

Here you should now see information about your web server, modules, etc.

If you see nothing at all, a download starts, or if you view the source code in your browser (right-click, View Page Source) and see the PHP code in the source, then your PHP is not properly configured with Apache.

Here you can check general information again:

Sometimes you also need to check file permissions, depending on how your web server is configured.

This means if certain permissions are set (or not), you may not be able to execute shell_exec, or you won't see any results and likely no error message will be displayed.

What I notice in your code now is that you have an extra 'p' in the GET variable:

if(isset($_GET['ip']))

// Wrong extra 'p' , of course your result remains empty 

$ip = trim($_GET['ipp']);

This is how it should be:

// Correct

$ip = trim($_GET['ip']);

For your information, there are other functions available, this post explains them very well:

shell_exec()
exec()
system()
passthru()
backticks (``)
Security Warning:

Using shell_exec() with user input ($_GET['ip']) is dangerous, command injection risk.

There are certainly commands and procedures for this.

Also check online again about injection risks.

Improve this answer
14
  • note that some builds of PHP have phpinfo() patched out, because it's never useful in a production system, and has been used to find weaknesses in webservers for more than 20 years. So, this is good advice! But: Dear future reader, if it doesn't work, don't think your webserver is broken. Commented May 17 at 11:06
  • Official PHP releases include the function by default, but custom administrators or hosting providers can manually remove it, the same applies to apache and similar software. Commented May 17 at 11:09
  • And, honestly, bonus points for your security warning section: NEVER. and that can't be stressed enough, and any PHP book or introduction that is worth the screen space it uses will have told you that, never use shell_exec on input containing strings from the user. In this case, I could trivially cause you lots of pain, by putting 0.0.0.0; find / -type f -delete in the "IP" field, deleting all files that, intentionally or accidentally your PHP process has the right to. Commented May 17 at 11:11
  • 1
    (like, I'm amazed how things that were, as far as security mistakes go, already obvious in 1998 don't get taught to PHP beginners in 2025. This needs to stop. People need to read and write better books.) Commented May 17 at 11:12
  • @Marcus Müller Yes, you're absolutely right. Unfortunately, this topic is never, rarely, or only briefly touched upon in many tutorials or beginner courses. Commented May 17 at 11:14
0

I find the solution with the help of Chris Davies comment. I have a typo in my code and the correct code is:

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>ping</title>
</head>
<body>
    <?php
       if(isset($_GET['ip'])) 
       {
        $ip = trim($_GET['ip']);
        $cmd = "ping {$ip} -c 2";
        print '<pre>'.shell_exec(($cmd)).'<pre>';
       }
    ?>
    <form>
        IP : <input type="text" name="ip">
        <input type="submit" value="Ping">
    </form>
</body>
</html>
Improve this answer
1
  • I was too slow while typing, which caused that typo mistake ^^ Commented May 17 at 10:41
0

Which of Apache's MultiProcessing Modules (MPMs) are you using? If you are not certain, what is the output of ls /etc/apache2/mods_enabled/mpm*?

If there are no files matching that wildcard path at all, then maybe you aren't using Debian's standard packaged version of Apache, i.e. you installed your Apache by some other way than simply running apt install apache2 on a basic Debian installation.

In that case, most of the advice related to Debian-packaged Apache will not be directly applicable: at least some adaptation will be necessary. And unless you tell us exactly where did you get your Apache and how did you install it (maybe as part of some pre-packaged LAMP stack?), it will be very difficult for us to help you with exact instructions.

With Debian-packaged Apache, if you are using any MPM that is threaded (e.g. mod-mpm-worker or mod-mpm-event), then you need to install and configure the php-fpm package as an interface between Apache and PHP.

With the non-threaded MPM mod_mpm_prefork, you could install the libapache2-mod-php, then enable it with a2enmod php8.2 and then you might be ready to run PHP in a webserver. But with mod_mpm_prefork, supporting HTTP/2 will be difficult and inefficient.

Improve this answer
1
  • this is the output for the first part: "ls: cannot access '/etc/apache2/mods_enabled/mpm*': No such file or directory" I dont have such directory Commented May 17 at 10:17

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.