PHP: escapeshellarg - Manual

downloads | documentation | faq | getting help | mailing lists | reporting bugs | php.net sites | links | conferences | my php.net

search for in the

escapeshellcmd Program Execution

Last updated: Sat, 27 Jan 2007

view this page in

# escapeshellarg

(PHP 4 >= 4.0.3, PHP 5)

escapeshellarg -- Escape a string to be used as a shell argument

## Описание

string escapeshellarg ( string arg )

escapeshellarg() adds single quotes around a string and quotes/escapes any existing single quotes allowing you to pass a string directly to a shell function and having it be treated as a single safe argument. This function should be used to escape individual arguments to shell functions coming from user input. The shell functions include exec(), system() and the backtick operator.

## Список параметров

`arg`

  The argument that will be escaped.

## Возвращаемые значения

The escaped string.

## Примеры

Пример 1. escapeshellarg() example

`<?php system('ls '.escapeshellarg($dir)); ?>`

## Смотрите также

escapeshellcmd()
exec()
popen()
system()
backtick operator

add a note User Contributed Notes
escapeshellarg
22-May-2006 05:25
`Most of the comments above have misunderstood this function. It does not need to escape characters such as '$' and '`' - it uses the fact that the shell does not treat any characters as special inside single quotes (except the single quote character itself). The correct way to use this function is to call it on a variable that is intended to be passed to a command-line program as a single argument to that program - you do not call it on command-line as a whole.
The person above who comments that this function behaves badly if given the empty string as input is correct - this is a bug. It should indeed return two single quotes in this case.`
phpnet at lostreality dot org
11-Nov-2005 08:53
`This function does not escape $ it seems. This lets user embed shell variables such as $PATH into commands, which you may or may not want to allow. I'm using shell_exec() because I need the entire command as one string, and need access to the stdout data as one string as well.`
ludvig dot ericson at gmail dot com
01-Sep-2005 10:17
`It seems from my tests that escapeshellarg("`ls -al`") is _NOT_ escaped into \`ls -al\` as it should be.
Anyway, a bash/sh environment does not seem to interprett ` inside of a singleqoute (').
$ echo "`echo hello`"
hello
$ echo '`echo hello`'
`echo hello`
$ echo "\`echo hello\`"
`echo hello`
Just a tip.`
18-May-2005 11:37
`According to my test (PHP 4.3.10) there is no need to call escapeshellarg() on a filename that is being written to by proc_open, and probably others. E.g.
<?php
$process = proc_open("echo hi",
array(
0 => array("pipe", "r"),
1 => array("file", 'filename with spaces', "w"),
2 => array("pipe", "w"),
),
$pipes);
?>
creates a file named:
filename with spaces
In fact,
<?php
1 => array("file", escapeshellarg('filename with spaces')
?>
creates a file named:
'filename with spaces'
(quotes included in filename.) Maybe all the PHP functions that take a filename as a separate parameter work this way. I guess you just need to escape filenames when they are part of a single string command line such as with the backtick operator, system(), etc.`
antony lesuisse
22-Apr-2004 08:30
`NOTE: If you are using PHP >= 4.2 you should use the pcntl_* (Process
Control) functions instead of this hack.
PHP, before version 4.2, didn't provide any execl(3)-like or
execv(3)-like methods to invoke external programs, thus everything
goes trough /bin/sh -c and we are forced to quote arguments.
To make it worse escapeshellarg() behaves badly (IMHO) with an empty
string:
<?php
echo "mime-construct --to ".escapeshellarg($to)." --cc a@a.com";
?>
The following function is a wrapper to system(), and it can be adapted
to popen(),exec(),shell_exec():
<?php
# system with perl? semantics
function lib_system() {
$arg=func_get_args();
if(is_array($arg[0]))
$arg=$arg[0];
$cmd=array_shift($arg);
foreach($arg as $i) {
$cmd.=" ''".escapeshellarg($i);;
}
system($cmd);
}
# example1
lib_system("mime-construct","--output", "--to",$a,"--string",$b);
# example2
lib_system(array("mime-construct","--output", "--to",$a,"--string",$b));
?>`
vosechu at roman-fleuve dot com
25-Mar-2004 05:05
`If escapeshellarg() returned something on a null input it would probably break more programs than it helps. Even if it's two "'s or two ''s, this function wouldn't work the way it's supposed to (that is, returning nothing).
However, most people do not put "" into their commands but I can see where it might be useful at the same time.
Perhaps an option in the command that would return the type of null we want. I might want the null character to be returned, someone else might want '', and someone else might want nothing at all.`
php at floris dot nu
26-Mar-2003 07:27
`i also thought the output was gonna be between 's because that's the way windows handles arguments with spaces in them. i think we have a unix <> windows misunderstanding here...`
jbriggs at esoft dot com
04-Jan-2002 12:57
`This function returns nothing when called with an empty argument.
escapeshellarg("b'lah") returns 'b'\''lah'
but escapeshellarg("") returns ""`
add a note
escapeshellcmd Program Execution

Last updated: Sat, 27 Jan 2007
show source | credits | stats | sitemap | contact | advertising | mirror sites
Copyright © 2001-2007 The PHP Group
All rights reserved.
This mirror generously provided by: Yahoo! Inc.
Last updated: Sat Mar 10 11:33:19 2007 PST