Passing GET variable to php EXEC

Question

I've tried searching but haven't had much luck- apologies if this is answered somewhere.

I'm playing with a few bits and pieces and I was trying to pass a URL variable to EXEC. Here's what I was trying.. sc.exe is a program I have to pass a URL- the $GET_ID variable has to come from the URL

  $GET_ID =$_GET= ['myid'];
  exec('sc.exe --url=http://localhost/DS1/test.php?ID='.$GET_ID.'&TEST=1');
  echo $GET_ID;

When I try this code out- the GET variable doesn't seem to be passed, the program gets http://localhost/DS1/test.php?ID=&TEST=1'

I've done a bit of searching.. and this seems to be a restriction of sorts.. So what is the solution/ workaround ?

thanks

Stupid question ... but have you included the 'myid' in the query string with an actual value? Because it should work as you have it. — judda
– judda, Commented Apr 24, 2011 at 13:16

Pekka · Accepted Answer · 2011-04-24 13:14:48Z

5

You have an extra = in your code. This should work:

$GET_ID = $_GET['myid'];

however, directly passing user data to the command line is highly dangerous! It allows an attacker to execute arbitrary commands on the command line.

You must use escapeshellarg():

$GET_ID = escapeshellarg($_GET['myid']);

answered Apr 24, 2011 at 13:14

Pekka

451k150 gold badges989 silver badges1.1k bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Jürgen Thelen · Accepted Answer · 2011-04-24 13:15:11Z

1

Just remove the = after $_GET.

answered Apr 24, 2011 at 13:15

Jürgen Thelen

12.7k7 gold badges54 silver badges74 bronze badges

Collectives™ on Stack Overflow

Passing GET variable to php EXEC

2 Answers 2

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related