MENU


Program Execution Functions

We have seen how to execute PHP command strings with eval(…). You may also issue Unix or Windows commands within PHP.

escapeshellcmd($s) returns a string that escapes any characters in $s that might be used to ‘hack’ the shell command. In Unix, #&;`|*?~<>^()[]{}$\, \x0A and \xFF are preceded by a backslash. ‘ and “ are escaped only if they are not paired. In Windows, all these characters and % are replaced by a space instead, or preceded by ^.

escapeshellarg($s) returns a string that adds quotes around $s and replaces several special characters with a space, allowing you to pass a string directly, having it be treated as a single safe argument.