Executing PHP via command line

Question

I want to be able to execute PHP via command line with a $_GET variable. I understand I can do this with exec, but I'd like to understand more of the security risk and what things I should look out for. The parameter I want to pass is a MySQL auto_incremented ID returned from MySQL, so I'm not concerned with user input. But by merely allowing this to happen what things should be considered in regards to security?

The script will accept an order ID and send the customer an email invoice. This allows me to perform this function from multiple sections of the site only maintaining the code in 1 location.

netcoder · Accepted Answer · 2010-12-20 16:53:32Z

2

I don't think you really need to execute this from command line. Create a PHP function and include it in your multiple sections instead: it will be faster. Per example:

function sendInvoice($orderId) {
    // do something
}

Then call it:

include_once('send_invoice.inc.php');
sendInvoice(42);

This still allows code reuse and a single place where to maintain the code.

answered Dec 20, 2010 at 16:53

netcoder

68k19 gold badges129 silver badges142 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

BMBM Over a year ago

+1 much better solution then using a shell script for this kind of task

Christian · Accepted Answer · 2010-12-20 16:51:30Z

1

Why can't you use argv/argc?

$id = isset($argv[1]) ? (int)$argv[1] : (int)$_REQUEST['id'];

answered Dec 20, 2010 at 16:51

Christian

28.3k18 gold badges117 silver badges162 bronze badges

Comments

mario · Accepted Answer · 2010-12-20 17:02:28Z

For cmdline scripts $argv is the answer. But you can indeed inject $_GET variables as well. Just pre-define the QUERY_STRING environment variable accordingly:

putenv("QUERY_STRING=id=$id");
exec("php script.php");

Regarding security, cmdline php scripts could be more worriesome on shared hosting servers if they initiate administrative actions. But there is not much you can do about that. Keep strictly cmdline scripts out of the document_root, and apply file or directory permission if anyhow possible.

Collectives™ on Stack Overflow

Executing PHP via command line

3 Answers 3

1 Comment

Comments

Comments

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

Comments

Comments

Related