PHP + Shell script

Question

I'm trying to send a variable in shell command and get output on screen. When I white ping ping -c 5 google.com it's working, but when a put variable $username it's not. Why my variable is not working?

<html>
<head>
<title>Form</title>
</head>
<body>
<form method="post" action="7.php">
<input type="text" name="username">
<input type="submit">
</form>
</body>
</html>

<?php
$username = $_POST["username"];
$result = shell_exec('ping -c 5 $username');
echo "<pre>$result</pre>";
?>

This is an enormous security risk. What if I post ; rm -rf / to your script? — DaveRandom
– DaveRandom, Commented Sep 30, 2014 at 12:13

kaseOga · Accepted Answer · 2014-09-30 12:10:32Z

3

You are using single quotes, you need to concatenate the $username or use double quotes

<?php
$username = $_POST["username"];
$result = shell_exec('ping -c 5 ' . $username);
echo "<pre>$result</pre>";
?>

answered Sep 30, 2014 at 12:10

kaseOga

78110 silver badges24 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

dend Over a year ago

It's true. Wrong quotes. Thanks kaseOga.

Collectives™ on Stack Overflow

PHP + Shell script

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related