Preventing Command Injection in PHP

Use fixed commands with argument arrays or direct library APIs rather than building shell strings from untrusted input.

The examples introduce the underlying control before showing a verification and an application-level safeguard.

What You Will Build

Use fixed commands with argument arrays or direct library APIs rather than building shell strings from untrusted input.

Prerequisites

Use PHP 8.4 or newer, HTTPS for all authentication operations, and an application session or database where required. Example configuration values are placeholders, never production secrets.

Example 1: Basic Operation

Allowlist user values before passing them into an approved operation.

<?php
$allowed = ['day' => 'today', 'week' => 'last-week'];
$selected = $allowed[$_GET['range'] ?? ''] ?? null;
if ($selected === null) { http_response_code(400); exit; }
// Pass $selected to an approved internal API rather than a shell string.

Example 2: A Different Use Case

Use an argument array to avoid invoking a shell interpreter.

<?php
$command = ['/usr/bin/printf', '%s', 'Safe argument'];
$process = proc_open($command, [1 => ['pipe', 'w'], 2 => ['pipe', 'w']], $pipes);
if (is_resource($process)) {
    $output = stream_get_contents($pipes[1]);
    fclose($pipes[1]); fclose($pipes[2]);
    proc_close($process); echo $output;
}

Practical Example: Checking the Result

Prefer PHP libraries for filesystem tasks rather than shell commands.

<?php
$filename = 'monthly-report.csv';
if (!preg_match('/^[a-z0-9-]+\.csv$/D', $filename)) { throw new InvalidArgumentException('Invalid report name'); }
// Use a file or archive library instead of building a command like "zip " . $filename.
echo $filename;

Important Behavior and Edge Cases

Validation and escaping are not permission checks. Restrict executable paths, timeouts and service-account privileges.

Enforce controls on the server, test denial paths and do not assume that a snippet alone implements an entire production workflow.

Comparison with Related Functions

Common Beginner Mistakes

Key Takeaways

• Use fixed commands with argument arrays or direct library APIs rather than building shell strings from untrusted input.
• Validation and escaping are not permission checks. Restrict executable paths, timeouts and service-account privileges.
• Prepared SQL statements stop SQL injection, not operating-system command injection.

Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.