PHP system() runs an external command and streams its output directly to the response. The examples below show how the call behaves, where it is useful, and which limitations matter.
What Is system() in PHP?
Runs an external command and streams its output directly to the response.
Its call structure is:
system($command, [&$result_code])The first argument is an operating-system command string; optional status argument receives the exit status.
These are examples to study, not code that the SQL import executes. Operations that affect processes, uploaded files or filesystem permissions belong in a controlled environment with validated paths and appropriate access controls.
Example 1: Basic Usage
This example introduces system with a direct call and a small, readable input.
<?php
system("php -v", $exitCode);
var_dump($exitCode);Runs an external command and streams its output directly to the response. Never pass untrusted data into a shell; command output can disclose environment details.
Example 2: Another Behavior or Input
Compare this input with the previous example: changing the data or option can affect how system behaves.
<?php
system("php --version", $status);
if ($status !== 0) { error_log("Command failed"); }The changed input illustrates why output may differ with the chosen values or environment. Never pass untrusted data into a shell; command output can disclose environment details.
Practical Example: Using the Feature
The following example incorporates system into a workflow. Values such as paths, connection handles and configuration options must come from trusted application settings.
<?php
// Run only fixed, reviewed commands.
$command = "php -v"; system($command, $exitCode); if ($exitCode !== 0) { throw new RuntimeException("Unable to inspect PHP version"); }In a real application, check each operation result, validate values before use and clean up acquired resources. Never pass untrusted data into a shell; command output can disclose environment details.
Important Behavior and Edge Cases
- Purpose: Runs an external command and streams its output directly to the response.
- Key limitation: Never pass untrusted data into a shell; command output can disclose environment details.
- Failure handling: Check return values and handle invalid inputs and unavailable operating-system or extension features where relevant.
Comparison With Related Functions
| Function or Approach | Best Fit |
|---|---|
system() | Runs an external command and streams its output directly to the response. |
shell_exec() | Returns captured shell output instead of streaming it directly as system() does. |
Common Beginner Mistakes
| Mistake | Correct Approach |
|---|---|
| Never pass untrusted data into a shell; command output can disclose environment details. | The correct approach depends on this behavior: Never pass untrusted data into a shell; command output can disclose environment details. |
| Ignoring errors or cleanup after the operation. | Validate inputs and check each result; close files, restore settings or release resources when the operation requires it. |
Key Takeaways
- Runs an external command and streams its output directly to the response.
- Never pass untrusted data into a shell; command output can disclose environment details.
- Use the examples as starting points, and adapt environmental paths, resources and permissions rather than assuming fixed results.
system is useful when its specific behavior fits the problem. The safest implementations combine the correct API with input validation, error checking and resource cleanup.