Executes a shell command and optionally collects output lines and its exit status.
What Is exec() in PHP?
Executes a shell command and optionally collects output lines and its exit status.
Its syntax is:
exec(string $command, array &$output = null, int &$result_code = null): string|falseParameters:
$command— Accepted as string; required argument.$output— Accepted as array &; optional default null.$result_code— Accepted as int &; optional default null.
Return type: string|false. Never concatenate user input into shell commands. Avoid running shell programs where native PHP alternatives exist.
Availability: May be disabled by server policy; executes with the web process permissions.
Example 1: Basic Usage
<?php
echo function_exists("exec") ? "Available" : "Disabled";
Result: Results and availability depend on the current PHP process, system permissions, cache, filesystem or installed locale. Never concatenate user input into shell commands. Avoid running shell programs where native PHP alternatives exist.
Example 2: A Different Input
<?php
echo ini_get("disable_functions") ?: "No functions explicitly disabled";
Result: Results and availability depend on the current PHP process, system permissions, cache, filesystem or installed locale. Never concatenate user input into shell commands. Avoid running shell programs where native PHP alternatives exist.
Practical Example: Applying It in a Program
<?php
$allowedTask = "generate-local-report"; $allowedTasks = ["generate-local-report"]; if (in_array($allowedTask, $allowedTasks, true)) { echo "Run a fixed administrative command only in a controlled environment."; }
Result: Results and availability depend on the current PHP process, system permissions, cache, filesystem or installed locale. Never concatenate user input into shell commands. Avoid running shell programs where native PHP alternatives exist.
Important Behavior and Edge Cases
- Key behavior: Never concatenate user input into shell commands. Avoid running shell programs where native PHP alternatives exist.
- Environment: May be disabled by server policy; executes with the web process permissions.
Comparison With Related Functions
| Function | Purpose |
|---|---|
exec() | Executes a shell command and optionally collects output lines and its exit status. |
proc_open() | proc_open() gives more control over subprocess streams; exec() runs a command and collects its output lines. |
Common Beginner Mistakes
| Mistake | Correct Approach |
|---|---|
| Ignoring this behavior: Never concatenate user input into shell commands | Never concatenate user input into shell commands. Avoid running shell programs where native PHP alternatives exist. |
Key Takeaways
- Executes a shell command and optionally collects output lines and its exit status.
- Never concatenate user input into shell commands. Avoid running shell programs where native PHP alternatives exist.
- May be disabled by server policy; executes with the web process permissions.
Summary: Never concatenate user input into shell commands. Avoid running shell programs where native PHP alternatives exist.