Passing multiple PHP variables to shell_exec()?

Question

I am calling test.sh from PHP using shell_exec method.

$my_url="http://www.somesite.com/";
$my_refer="http://www.somesite.com/";
$page = shell_exec('/tmp/my_script.php $my_url $my_refer');

However, the command line script says it only received 1 argument: the /tmp/my_script.php

When i change the call to:

Code:

$page = shell_exec('/tmp/my_script.php {$my_url} {$my_refer}');

It says it received 3 arguments but the argv[1] and argv[2] are empty.

When i change the call to:

Code:

$page = shell_exec('/tmp/my_script.php "http://www.somesite.com/" "http://www.somesite.com/"');

The script finally receives all 3 arguments as intended.

Do you always have to send just quoted text with the script and are not allowed to send a variable like $var? Or is there some special way you have to send a $var?

Dave Chen · Answer 1 · 2013-06-05T05:34:28.000

28

Change

$page = shell_exec('/tmp/my_script.php $my_url $my_refer');

to

$page = shell_exec("/tmp/my_script.php $my_url $my_refer");

OR

$page = shell_exec('/tmp/my_script.php "'.$my_url.'" "'.$my_refer.'"');

Also make sure to use escapeshellarg on both your values.

Example:

$my_url=escapeshellarg($my_url);
$my_refer=escapeshellarg($my_refer);

edited Jun 05 '13 at 05:34

answered Jun 05 '13 at 05:28

Dave Chen

10,887
8
39
67

2

PHP will only parse `$` variables wrapped around double quotes (`"`). – Dave Chen Jun 05 '13 at 05:29
3

also make sure you sanatize with escapseshellarg – Orangepill Jun 05 '13 at 05:29
See the docs for the differences between single- and double-quoted strings: http://php.net/manual/en/language.types.string.php – DaoWen Jun 05 '13 at 05:30
I don't think it would help. He`d better embed quotes inside. – David Jashi Jun 05 '13 at 05:31
And what about spaces in filenames? – David Jashi Jun 05 '13 at 05:33

Code Lღver · Accepted Answer · 2017-03-09T06:32:31.787

18

There is need to send the arguments with quota so you should use it like:

$page = shell_exec("/tmp/my_script.php '".$my_url."' '".$my_refer."'");

edited Mar 09 '17 at 06:32

answered Jun 05 '13 at 05:30

Code Lღver

15,573
16
56
75

1

yeah how do you grab those parameters in the "/tmp/my_script.php" ? – Alfonso Fernandez-Ocampo Nov 26 '14 at 15:19
@AlfonsoFernandez-Ocampo Try `print_r($_POST);` to get the parameters. – Code Lღver Nov 28 '14 at 06:21
@AlfonsoFernandez-Ocampo **print_r($_SERVER['argv']));** – Faiyaz Alam Jul 18 '16 at 11:18
This will absolutely not work. Variables are not interpolated in single quoted strings. – miken32 Mar 07 '17 at 20:19
@miken32 Perhaps you have not seen braces which is used to manipulate the variables. – Code Lღver Mar 08 '17 at 06:23
Those are also not interpreted in single quoted strings. – miken32 Mar 08 '17 at 06:29
http://php.net/manual/en/language.types.string.php#language.types.string.syntax.single – miken32 Mar 08 '17 at 06:30

score 9 · Answer 3 · answered Jun 05 '13 at 05:35

9

Variables won't interpolate inside of a single quoted string. Also you should make sure the your arguments are properly escaped.

 $page = shell_exec('/tmp/myscript.php '.escapeshellarg($my_url).' '.escapeshellarg($my_refer));

answered Jun 05 '13 at 05:35

Orangepill

24,500
3
42
63

score 2 · Answer 4 · answered Jun 05 '13 at 05:31

2

Change

$page = shell_exec('/tmp/my_script.php $my_url $my_refer');

to

$page = shell_exec('/tmp/my_script.php "'.$my_url.'" "'.$my_refer.'"');

Then you code will tolerate spaces in filename.

answered Jun 05 '13 at 05:31

David Jashi

4,490
1
21
26

Yes, I do intentionally. My real mistake was, that I forgot to take out `$my_url` and `$my_refer` out of string. – David Jashi Jun 05 '13 at 05:35

score 2 · Answer 5 · answered Jun 05 '13 at 05:49

You might find sprintf helpful here:

$my_url="http://www.somesite.com/";
$my_refer="http://www.somesite.com/";
$page = shell_exec(sprintf('/tmp/my_script.php "%s" "%s"', $my_url, $my_refer));

You should definitely use escapeshellarg as recommended in the other answers if you're not the one supplying the input.

score 2 · Answer 6 · edited Jul 30 '15 at 12:21

I had difficulty with this so thought I'd share my code snippet.

Before

$output = shell_exec("/var/www/sites/blah/html/blahscript.sh 2>&1 $host $command");

After

$output = shell_exec("/var/www/sites/blah/html/blahscript.sh 2>&1 $host {$command}");

Adding the {} brackets is what fixed it for me.

Also, to confirm escapeshellarg is also needed.

$host=escapeshellarg($host);
$command=escapeshellarg($command);

Except script also needed:

set host [lindex $argv 0]
set command [lindex $argv 1]

Passing multiple PHP variables to shell_exec()?

6 Answers6

Linked