OS command injection (ARCH7102)

Key php.security.os-command-injection · Severity error · Category security · CWE CWE-78

Building a command string from user input and passing it to a shell lets attackers chain extra commands via shell metacharacters. Arguments must be escaped or the shell avoided.

Incorrect

<?php
$host = $_GET['host'];
$output = shell_exec("ping -c 1 $host");
echo $output;

Correct

<?php
$host = $_GET['host'];
$cmd = 'ping -c 1 ' . escapeshellarg($host);
$output = shell_exec($cmd);
echo htmlspecialchars($output);

Fix

Escape arguments with escapeshellarg() or validate against an allowlist instead of passing input straight to a shell.