CODEWITHSUNDEEP
phpms-wordexecdoc
Fernando Valente
Fernando Valente

Reputation: 1096

PHP: antiword and uploaded file

I'm creating some code that will upload the contents of a word document to a server, extract its text, and insert it into a database.

exec("PATH=$PATH:/home1/myserver/bin && antiword " . 
     $_FILES['file']['tmp_name'], $mycontent);

For some bizarre reason, $mycontent is always an empty array. Google wasn't that helpful. Does anyone know what I'm doing wrong?

Upvotes: 0

Views: 1111

Answers (1)

evan
evan

Reputation: 12543

The $PATH in your exec quote is trying to be converted to whatever your PHP $PATH is rather than the BASH $PATH.

You can either escape the $ (\$) or use single quotes.

In general, you should be using escapeshellarg() or escapeshellcmd() to make things a bit safer. It would have prevented this situation. Also if you call exec() with user inputs, it will help prevent them from escaping your command and calling their own malicious shell commands.

EDIT
Actually, you might have issues with your filename/path for some reason. Just start simple.

Does this work:

exec('/home1/myserver/bin/antiword ' . 
          escapeshellarg($_FILES['file']['tmp_name']), $mycontent);

If not, what is this:

echo '/home1/myserver/bin/antiword ' . 
          escapeshellarg($_FILES['file']['tmp_name']);

You'll have to create a file to test, and substitute it for the file in $_FILES. But does that work directly from the commandline?

Upvotes: 1

Related Questions