CODEWITHSUNDEEP
phplinuxsecurityoptimizationshell-exec
Jimbo
Jimbo

Reputation: 26624

PHP shell_exec() - Run directly, or perform a cron (bash/php) and include MySQL layer?

Sorry if the title is vague - I wasn't quite sure how to word it!

What I'm Doing

I'm running a Linux command to output data into a variable, parse the data, and output it as an array. Array values will be displayed on a page using PHP, and this PHP page output is requested via AJAX every 10 seconds so, in effect, the data will be retrieved and displayed/updated every 10 seconds. There could be as many as 10,000 characters being parsed on every request, although this is usually much lower.

Alternative Idea

I want to know if there is a better* alternative method of retrieving this data every 10 seconds, as multiple users (<10) will be having this command executed automatically for them.

A cronjob running on the server could execute either bash or php (which is faster?) to grab the data and store it in a MySQL database. Then, any AJAX calls to the PHP output would return values in the MySQL database rather than making a direct call to execute server code every 10 seconds.

Why?

I know there are security concerns with running execs directly from PHP, and (I hope this isn't micro-optimisation) I'm worried about CPU usage on the server. The server is running a sempron processor. Yes, they do still exist.

Having this only execute when the user is on the page (idea #1) means that the server isn't running code that doesn't need to be run. However, is this slow and insecure?

Just in case the type of linux command may be of assistance in determining it's efficiency:

shell_exec("transmission-remote $host:$port --auth $username:$password -l");

I'm hoping that there are differences in efficiency and level of security with the two methods I have outlined above, and that this isn't just micro-micro-optimisation. If there are alternative methods that are better*, I'd love to learn about these! :)

Upvotes: 1

Views: 714

Answers (2)

slashingweapon
slashingweapon

Reputation: 11317

If you are going to produce all the information you need for all of your users every 10 seconds, then maybe you should:

  • Use PHP for your cron job
  • Generate the data you want in the format in which it is to be served
  • Save the output files in your web folder heirarchy
  • Let the client retrieve it as a static file

Upvotes: 1

Jared White
Jared White

Reputation: 56

I think the idea of a separate cron job doing the data processing is a sound one. You're right -- directly executing server commands from a PHP script is not the most secure way of doing things and generally should be avoided.

However, from a performance standpoint, you may not want to be accessing a MySQL database constantly for the data either, especially if it's always changing and updating. I would suggest using a key-val storage system like Memcache, or if you don't have much memory available, something that's a hybrid of disk/memory storage. Your background process would update the value of the key at regular intervals and then you'd access that from your main web server process.

Upvotes: 2

Related Questions