PHP exec，system或passthru都删除单引号或双引号 [英] PHP exec, system or passthru all remove single or double quotes
问题描述
每当我尝试通过php的exec/passthru/system函数对shell执行命令时，似乎都会删除命令中的引号.
When ever I try to execute a command to the shell via php's exec/passthru/system functions it seems to remove quotes from the command.
$str_file = '1323988284_700.csv';
exec("/usr/bin/lftp -e 'set ftp:passive-mode true; set ftp:ssl-protect-data yes; put /web/files/{$str_file}; bye;' -u user,pass ftp://ftp.site.com/uploaddir/");
这是检查过程的输出
ps faxxx | grep lftp
4486 ? S 0:00 | \_ /usr/bin/lftp -e set ftp:passive-mode true; set ftp:ssl-protect-data yes; put /web/files/1323988284_700.csv; bye; -u user,pass ftp://ftp.site.com/uploaddir/
如您所见，它显示的是没有单引号的情况下运行的过程.这会导致lftp错误.
As you can see it's showing the process running with out the single quotes. This causes lftp to error.
现在它只是挂起，直到我杀死它为止，我相信这是因为，如果我在命令中键入进程列表中显示的内容，它将出错并留给lftp shell.
Now it just hangs untill i kill it, i believe this is because if i type what is shown in the process list into the command like, it will error and leave you at the lftp shell.
PHP安全模式已关闭
PHP Safemode is OFF
我已经尝试过以下内容作为报价
I have tried the following for the quote's
\'
\\'
\\\'
\\\\'
''
'''
''''
更新
我想在进一步测试时添加它..如果我创建一个shell脚本(run_ftp.sh)并通过php运行它，它也会从run_ftp.sh中删除引号..因此，这使我认为它不是php导致问题.
UPDATE
I'd like to add that upon further testing.. if I create a shell script (run_ftp.sh) and run that via php it also removes the quotes from the run_ftp.sh.. so this makes me think its NOT php causing the issue.
SELinux已关闭..linux/bash是否有其他可能导致此问题的安全措施?
SELinux is off.. Is there any other security measures that linux/bash has in place that could cause this?
推荐答案
exec() 和 system() 命令通过外壳传递. Shell分析命令行并删除引号.但是，它将整个字符串保留为一个参数，并将其铲起到实际的 execve() 系统调用等.
exec() and system() commands in PHP are passed over the shell. The shell parses the commandline and removes the quotes. It however keeps the whole string as one parameter, and shovels it to the actual execve() system call etc.
应用程序将收到用单引号作为一个参数的字符串.但是ps工具可能只是按原样列出它们.
The application will receive your string that was in single quotes as one parameter. The ps tool however might just list them as is.
但是，可能是lftp工具自己进行了一些解析(-e标志听起来像这样).在这种情况下，两个级别的报价可能会有所帮助:
It might however be that the lftp tool does some parsing of its own (the -e flag sounds like that). In which case two levels of quotes might help:
exec("lftp -e '\'multiple; commands; for the lftp thingy\''");
这篇关于PHP exec，system或passthru都删除单引号或双引号的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
