4 ms·
Ah yes, "PHP "security"". Yes, untrusted user input going to the shell is a bad idea, even when "sanitized". Of course, unlike other saner languages, bypassin
by labster 9y ago
Ah yes, "PHP "security"". Yes, untrusted user input going to the shell is a bad idea, even when "sanitized".
Of course, unlike other saner languages, bypassing the shell isn't always an option. When running under Apache, pcntl_exec() isn't available, so you just gotta hope rely on escapeshellarg(), addbackslashes(), and prayer.
- deleted 9y ago[deleted]
- chatmasta 9y agoYou should be running your application code in some sort of sandbox anyway, to minimize the data available to an attacker in the event of privilege escalation.