PHP在php文件上调用exec以在后台执行

Question

I want to execute a PHP file with exec , to handle a process in the background, where 1234567 is an id I wish to call from a database to get some information about what I am about to process.

exec('/var/www/somescript.php 1234567 > /dev/null &');

Are there any potential security issues or problems I may run into?

Should I use escapeshellarg() on the parameter I am passing in?

Answer 1

I'm sure this depends on if this should be called via a web user and if the arguement or executed command is created by the user.

Using escapeshellarg() in my opinion should always be called as you wouldn't use the MYSQL_ function and not escape any of the input due to risk of SQL injection. Using the exec function is a similar issue, you wouldn't use the script without escaping the input. However, escaping the input doesn't necissarily stop people abusing the script.

You do need to make sure validation has been done for any arguments sent over to the script for example you don't want anyone to comment out your script and in the arguement section inject a completely different script to maybe add a user (this shouldn't be allowed to happen given propper permissions).

I would use this as the last resort, if the issue can't be solved any other way rather then using an exec.