Is using shell commands from PHP/CGI bad practice?

Question

Are shell commands considered a legitimate programming interface? Specifically, is there anything wrong with executing bash shell commands on a linux application server from PHP pages or CGI files? Does this introduce efficiency or security issues?

Thanks

There are two kinds of people. Ones who use a tool and ones who asks if it legitimate — Your Common Sense
– Your Common Sense, Commented Dec 26, 2010 at 23:43
Anonymous close voters are the bane of SO... please explain yourselves! — Yarin
– Yarin, Commented Dec 27, 2010 at 0:12

DigitalRoss · Accepted Answer · 2010-12-26 23:52:05Z

6

Sometimes OK, but...

Sometimes it's the best way to solve a problem.

But possible issues are:

Security

Look out for code injection if you aren't doing taint checking.

Performance

Running shell commands will involving forking the PHP interpreter and executing complex and relatively slow system calls. This is OK for a lightly loaded server but won't work for a busy site.

Synchronization

Ensuring that things happen in the right order avoids well-known problems called lost updates, dirty reads, and incorrect summaries. While shell commands are not by themselves a cause of any of these things, running them asynchronously can be, and increasing the complexity of your system will make it harder to analyze.

edited Dec 26, 2010 at 23:52

answered Dec 26, 2010 at 23:44

DigitalRoss

147k25 gold badges255 silver badges338 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Your Common Sense Over a year ago

Sure. To process an image with ugly GD would be Ok, and with swift external imagemagick would be slow, haha

DigitalRoss Over a year ago

Using an external ImageMagick may well be superior from a memory usage standpoint as well, as processing images internally can explode the memory footprint of web servers, in fact, I've seen that happen. I did say that "sometimes it's the best way to solve a problem".

ajreal Over a year ago

another example will be ffmpeg, not sure how to survive without shell

Yarin Over a year ago

Good points here- thanks. Where can I go to learn more about taint checking in this scenario?

sorpigal Over a year ago

In the case of ImageMagick it can also be necessary to call the command line version since not all features of the various commands actually work from all languages.

Teson · Accepted Answer · 2011-12-07 15:23:56Z

0

If secure application and server, no.

edited Dec 7, 2011 at 15:23

user142162

answered Dec 26, 2010 at 23:42

Teson

6,7469 gold badges50 silver badges70 bronze badges

Collectives™ on Stack Overflow

Is using shell commands from PHP/CGI bad practice?

2 Answers 2

Sometimes OK, but...

5 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Sometimes OK, but...

5 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related