CODEWITHSUNDEEP
phpshell-exec
Justin Cooper-Marsh
Justin Cooper-Marsh

Reputation: 11

PHP multiline input from shell_exec not woking as expected

I have the following PHP post from HTML

The output from the mvsce -d 1234-56-78 -l 1 -s 1 command is displayed from bash as follows

TAR 332 
PCXLA-TAACC

over the two lines.

The code below only ever outputs the 2nd line PCXLA-TAACC 

<?php
$mvdate=$_POST['fdate'];
$mvlevel=$_POST['flevel'];
$mvsite=$_POST['fsite'];

$mvse = shell_exec ('/usr/local/bin/mvsce -d "'.$mvdate.'" -l "'.$mvlevel.'" -s "'.$mvsite.'"');

echo $mvse;

?>

How can I get the code to display both lines in a browser windows?

The HTML I use to post for the PHP

<!DOCTYPE html>
<html>
<head>
</head>
<body>
<H1>makeVSCE Output</H1><br>
<br>
<br>
<form name="myForm" action="makevsce.php"
method="post">
Date (YYYY-MM-DD):<br>
<input TYPE="text" NAME="fdate"><br>
Level:<br>
<input TYPE="level" NAME="flevel"><br>
Sequence:<br>
<input TYPE="Sequence" NAME="fsite">

<input type="submit" value="Submit">
</form>
<br>
</body>
</html>

Upvotes: 0

Views: 717

Answers (2)

Justin Cooper-Marsh
Justin Cooper-Marsh

Reputation: 11

OK,

This is not an issue with PHP code.

If I write the output from the command to anything other than console it only writes the 2nd line.

Thanks for all your help.

Upvotes: 0

Paolo
Paolo

Reputation: 15847

How can I get the code to display both lines in a browser window?

Short answer: You have to render a minimal HTML page and format output according to HTML.

Let your script makevsce.php begin sending the client a minimal HTML page with the body "open":

<?php
header( "Content-Type: text/html; charset=utf-8" );

echo "<!DOCTYPE html>\n";
echo "<html>\n";
echo "<head>\n";
echo "<meta charset=\"utf-8\">\n";
echo "<title>Shell Output (or whatever...)</title>\n";
echo "</head>\n";
echo "<body>\n";

Let PHP properly escape the arguments injected in the string passed to the shell.

$mvdate  = escapeshellarg( $_POST['fdate'] );
$mvlevel = escapeshellarg( $_POST['flevel']);
$mvsite  = escapeshellarg( $_POST['fsite'] );

Use exec instead of shell_exec

exec( "/usr/local/bin/mvsce -d $mvdate -l $mvlevel -s $mvsite",
      $mvse,
      $return_value );

$mvse (passed by reference) will receive an array containing all the lines sent as output from the invoked command.

While the (optional) parameter $return_value holds the return value of the shell command.

To display the output:

foreach( $mvse as $line ) {
    echo htmlspecialchars( $line ) . "<br>\n";

Note that prior printing each output line text is properly HTML escaped since you're talking about displaying output in a browser.

At the end of each line a <br> will be interpreted by the browser as a line break.

Finally to close the HTML page:

echo "</body>\n";
echo "</html>";

Security notice:

Be aware you're executing via the shell a command created using input from the client.

A properly forged request may cause execution of arbitrary command with the same privileges as the PHP runtime.

Upvotes: 1

Related Questions