CODEWITHSUNDEEP
phpcommand-line
Ben
Ben

Reputation: 62464

Executing PHP via command line

I want to be able to execute PHP via command line with a $_GET variable. I understand I can do this with exec, but I'd like to understand more of the security risk and what things I should look out for. The parameter I want to pass is a MySQL auto_incremented ID returned from MySQL, so I'm not concerned with user input. But by merely allowing this to happen what things should be considered in regards to security?

The script will accept an order ID and send the customer an email invoice. This allows me to perform this function from multiple sections of the site only maintaining the code in 1 location.

Upvotes: 0

Views: 350

Answers (3)

mario
mario

Reputation: 145512

For cmdline scripts $argv is the answer. But you can indeed inject $_GET variables as well. Just pre-define the QUERY_STRING environment variable accordingly:

putenv("QUERY_STRING=id=$id");
exec("php script.php");

Regarding security, cmdline php scripts could be more worriesome on shared hosting servers if they initiate administrative actions. But there is not much you can do about that. Keep strictly cmdline scripts out of the document_root, and apply file or directory permission if anyhow possible.

Upvotes: 1

netcoder
netcoder

Reputation: 67745

I don't think you really need to execute this from command line. Create a PHP function and include it in your multiple sections instead: it will be faster. Per example:

function sendInvoice($orderId) {
    // do something
}

Then call it:

include_once('send_invoice.inc.php');
sendInvoice(42);

This still allows code reuse and a single place where to maintain the code.

Upvotes: 2

Christian
Christian

Reputation: 28165

Why can't you use argv/argc?

$id = isset($argv[1]) ? (int)$argv[1] : (int)$_REQUEST['id'];

Upvotes: 1

Related Questions