Securing exec against executing adversary shell commands

Question

I have to execute my .o or .out binary file pre-compiled with gcc, it should be intended to let the user execute the small program so an action is made that connects with the app installed on the user's phone.

But i want to prevent other code not related to this concept from being executed at the same time. What i have is one constant that contains the specified command that must be executed.

<?php
     DEFINE('program', './main.out');
     exec(program);

Or working with a variable that acts as a pointer: exec($executable); ( However i think this is less secure ).

---

Another way: In a class, declaring a private constant prep that has the line that must be executed in the next procedure, a function, which then executes the escaped specific line. To give an example

    private const prep = "./main.out";

    function executeProgram()
    {
        $e = exec(escapeshellcmd(self::prep));

        exit();
    }

1. Is there a way to make this function(exec) fully private from being accessed by others?
2. How to sanitize it? using escapeshellcmd() would be ok.
3. Is it safe to use pointers for or in this function? let's say $executable
4. Is there any other risk that i must think about, then i'm thinking about the program itself?

Answer 1

For sanitization, You can refer here https://stackoverflow.com/questions/42657352/how-can-i-stop-command-injection-when-using-shell-exec-in-php7

TL;DR:

Use escapeshellcmd for escaping full command to be executed, or escapeshellarg to escape arguments only for given command.