Re: [nyphp-talk] escapeshellcmd stupidity?

[Allen Shaw]

Daniel Convissor wrote: On Fri, Jan 02, 2009 at 02:37:43PM -0600, Allen Shaw wrote: In my case, I'm passing multiple arguments, but I'm now regexing them apart into separate arguments, so escapeshellarg() does work. I would submit each argument as a separate POST or GET parameter. Each argument would have a key (the name of the shell script flag) and a value (uh, the value). I probably won't do this.  I'm aiming for an interface that looks and feels like a command line.  A single form field that looks and acts like a command line is a lot more fun for the user than 4 separate fields -- at least it is when I'm the user.  If acceptable input for this shell script is `/path/to/script [options] action [task-number] [task-description]` then I can hardcode the script path and prompt only for the rest ([options] action [task-number] [task-description]), then manipulate the input string to get the various relevant parts.  forward compat with the wrapped shell script, I'm hoping to avoid checking for valid arguments and instead just escaping each argument and letting the shell script do its own checking. Oh, quit whining... do the right thing. ... Duly noted.  I suppose there aren't that many possible permutations to screen for.  (darn it...) If you want to be really slick, have your shell script provide output of usage or a list of allowed arguments in a format that will be easy for your PHP script to parse into an array. Then have the PHP script call the shell script using "/script --help" (or similar) and parse the output into an array, then use that array to validate GET/POST. Very cool idea, actually.  Unfortunately it's a public script belonging to someone else and used by a (mildly active) community, not my own shell script.  Probably could parse the -h output into an array for validation, but it seems easier to just hardcode the options and check for those, then modify the php wrapper if/when the shell script interface changes. Thanks, A. -- Allen Shaw slidePresenter (http://slides.sourceforge.net)

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php