I have the following script:
$user_input = $_POST['user_input']; // If there is a way, I want to escape it here. shell_exec("php some_file.php $user_input");
Is there a way to properly escape the
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
The function escapeshellarg safely quotes a value (including escaping quotes in the name, etc) so that it can be used as an argument in a command string passed to a shell.
$user_input = $_POST['user_input']; shell_exec('php some_file.php '.escapeshellarg($user_input));