PHP执行SH文件

Question

I'm attempting to launch a sh file through PHP with arguments, however I cannot get this working at all:

<?php
$ip = $_GET['ip'];
$port = $_GET['port'];

echo shell_exec('sh var/www/html/Grant73565/Grant.sh $ip $port')or die("bash didn't work");
echo('Sent!');
?>

Running the file through ssh manually works fine like:

./Grant.sh 127.0.0.1 80

However in php it just echo's "Bash didn't work".

It's not to-do with the arguments as far as I know as it's not even launching the file without them.

Answer 1

You need to use double-quotes if you want to include a variable.

echo shell_exec("sh var/www/html/Grant73565/Grant.sh $ip $port") or die("bash didn't work");

With your current code, anybody can alter the http query and execute anything on your server. This is a major security hole.

The solution is to verify the input. The port will always be numeric so that's simple. You can use a regular expression to verify the IP address.