Safe executing shell scripts; escaping vars before execution

Question

Let\'s imagine that we have a simple php script that should get ssh_host, ssh_username, ssh_port from $_GET array and try to connect u

Answer 1

I would say that this is what the escapeshellarg function has been created for -- so, to escape parameters, that's the one you should be using.

Basically :

• To escape one parameter, use escapeshellarg
• And to escape a command as a whole, use escapeshellcmd.

Quoting their respective documentations :

escapeshellcmd() :
This function should be used to make sure that any data coming from user input is escaped before this data is passed to the exec() or system() functions, or to the backtick operator.

escapeshellarg() :
This function should be used to escape individual arguments to shell functions coming from user input.