Shell command execution
Why it matters
Input passed to the shell can append extra commands with characters such as ; or |, handing the attacker control of the server. Validate the value strictly and quote every argument.
system('ping -c 1 ' . $_GET['host']);$host = $_GET['host'] ?? '';
if (!filter_var($host, FILTER_VALIDATE_IP)) {
exit('Invalid address');
}
system('ping -c 1 ' . escapeshellarg($host));How to fix
Avoid shell calls. If you must, pass each argument through escapeshellarg() and never include user input in the command name.
Scan my code
Scan my code β
Paste a file and PHP Safe points to every line that matches this rule.