php - Escape php variables in exec()

Question

Morning guys,

Am having trouble escaping a string with variables that I want to pass to exec(). Here is the string:

$send_telemetry = exec ( 'echo "Temp 1="'.$temp_1[0].'" Pressure 1="'.$pressure_1[0].'" Flow 1 ="'.$flow_1[0].'" | mutt -s "Telemetry values for AREA 11C" [email protected]' ) ;
echo "$send_telemetry" ;

I had this working before, but some over eager newbie technician thought it a smart idea to change the code and he ended up making a mess out of it. I am aware of shell_exec() but I prefer exec().

Thank you

Kagiso Marvin Molekwa · Accepted Answer · 2018-11-24 08:55:50Z

4

from the PHP website about the function escapeshellarg

escapeshellarg() adds single quotes around a string and quotes/escapes any existing single quotes allowing you to pass a string directly to a shell function and having it be treated as a single safe argument. This function should be used to escape individual arguments to shell functions coming from user input. The shell functions include exec(), system() and the backtick operator.

So what you should probably be doing is escaping any variables that you are passing into your command, like so...

$send_telemetry = exec ( 'echo "Temp 1=" ' . escapeshellarg($temp_1[0]) . ' "Pressure 1=" ' . escapeshellarg($pressure_1[0]) . ' "Flow 1 =" ' . escapeshellarg($flow_1[0]) . ' " | mutt -s "Telemetry values for AREA 11C" [email protected]' ) ;
echo "$send_telemetry" ;

edited Nov 24, 2018 at 8:55

answered Nov 23, 2018 at 6:24

Kagiso Marvin Molekwa

9892 gold badges10 silver badges25 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

php - Escape php variables in exec()

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related