4 ms·
The PHP script is super simple, so lighttpd (which is a great web server, in the same performance realm of nginx) and php-fpm on a shared VPS, is plenty of powe
by nodesocket 14y ago
The PHP script is super simple, so lighttpd (which is a great web server, in the same performance realm of nginx) and php-fpm on a shared VPS, is plenty of power and resources.
Never seen $found = `grep $udid FILE` using back-ticks in PHP land. Is that the same as the exec() function?
- bbunix 14y agoeffectively the same, more like a system() call... impressively ugly I must say.
- Osiris 14y agoI've seen this used in a PHP git class to call git and capture the results. (Obviously) Just make sure you're not including any user input data in any variables you put in there.
- thwarted 14y agoIt's also grossly insecure unless you sanitize $udid, which thankfully the author of this script does. It's still relatively unsafe, as it invokes external programs through a shell, so you're dependent on the shell's environment, which can diverge on different systems. Last I checked, PHP did not have an easy, obvious way to safely invoke another program. You can do it manually with a mix of pcntl_fork and pcntl_exec, but capturing the output using that is more difficult.
- fooyc 14y agoPHP provides escapeshellcmd / escapeshellarg functions for escaping when building commands. Is there any shell on which those functions are unsafe ? I think they assume cmd.exe on windows and sh on others.
- thwarted 14y agoEscaping is difficult to get right, especially in PHP... witness things like magic quotes that existed for so long. The right thing to do is provide an output capturing API that does not require escaping because it takes a list of strings passed to the exec(2) system call.