从PHP传递'>'符号到PERL

Question

I would like to use PHP to pass two values (I get from a php form) into a perl script in order to process these. I am able to do this just fine with all characters but not the '>' sign , what can I do to repair this..?

This is my php code:

<?php   
    $val="$_POST['val']";
    $val2="$_POST['val2']";
      system("/usr/bin/perl script.pl $val $val2",$retval); 
    if($retval!=0){
        echo ("<p> There was an unknown error.");
    }
?>

Thanks!

Answer 1

system("/usr/bin/perl script.pl '$val' '$val2'",$retval);

If you have ' char in $var1 or $var2, you should escape it.

Anyway, passing $_POST, without sanitize, is very very dangerous!

Answer 2

正如@po_taka已经提到过你需要清理$ _POST数据，使用PHP函数escapeshellarg 。

system("/usr/bin/perl script.pl ".escapeshellarg($val)." ".escapeshellarg($val2),$retval);