3 ms·
It's also grossly insecure unless you sanitize $udid, which thankfully the author of this script does. It's still relatively unsafe, as it invokes external pro
by thwarted 14y ago
It's also grossly insecure unless you sanitize $udid, which thankfully the author of this script does.
It's still relatively unsafe, as it invokes external programs through a shell, so you're dependent on the shell's environment, which can diverge on different systems. Last I checked, PHP did not have an easy, obvious way to safely invoke another program. You can do it manually with a mix of pcntl_fork and pcntl_exec, but capturing the output using that is more difficult.
- fooyc 14y agoPHP provides escapeshellcmd / escapeshellarg functions for escaping when building commands. Is there any shell on which those functions are unsafe ? I think they assume cmd.exe on windows and sh on others.
- thwarted 14y agoEscaping is difficult to get right, especially in PHP... witness things like magic quotes that existed for so long. The right thing to do is provide an output capturing API that does not require escaping because it takes a list of strings passed to the exec(2) system call.