过滤 var 以在 php 上使用系统调用 shellscript

问题描述

我需要过滤那些 var 以在 php 中调用系统并执行 shell 脚本.我需要使用什么 filter_var SANITIZE 宏来删除;"或者shell执行过程中的问题?像不需要的字符..等..等

i need to filter those var to call system in php and execute a shell script. What filter_var SANITIZE macro i need to use to remove ";" or problems during shell execution? Like unwanted chars..etc..etc

这是我的代码测试示例，现在我已经对 var 进行了硬编码以进行测试..谢谢！

This is my code testing example, now i've hardcoded the var for testing.. Thanks!

$ragionesociale = $_GET["ragionesociale"]; /* Alphanumeric with spaces next trimmed*/
$api = $_GET["ragionesociale"]; /* Uri with space encoded*/
$sito = $_GET["sito"]; /* Uri with space encoded*/
$meta = $_GET["meta"]; /*Address, CF, a lot of things...*/
$tmp_dir = "tmp_app";


if(!filter_has_var(INPUT_GET, "ragionesociale") ||
   !filter_has_var(INPUT_GET, "sito") ||
   !filter_has_var(INPUT_GET, "meta") ||
   !filter_has_var(INPUT_GET, "api")
){
 echo("Input type does not exist");
 exit();
}

 system("../configmyapp2.sh ".$ragionesociale." ".$api." ".$sito." ".$meta." ".$tmp_dir);

推荐答案

如果其他用户可以触发，我不会采用这种方法.

If this can be triggered by other users then I would not go by this method.

这是非常危险的，尤其是您的多个参数和清理规则.

Its very dangerous, especially with your multiple parameters and sanitization rules.

这篇关于过滤 var 以在 php 上使用系统调用 shellscript的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！