PHP programming forum. Ask questions or help people concerning PHP code. Don't understand a function? Need help implementing a class? Don't understand a class? Here is where to ask. Remember to do your homework!
I've been reading a book on PHP security which is heavily focused of filtering any data that is sent to the server and I've gone back to an old script I created which is a web based PHP dig/ping/whois tool. It allows users to enter a domain or IP and obtain details using the function
Try this... enter "; ls -la" and check the output... it'll probably show you a list of files.
Assuming that worked, i could then enter "; cat /etc/passwd" which will get me a list of user accounts on the system...
The best defense would be to use escape_shell_args() on the input to sanitize it.
The very best defense would be to not use system() but find a webservice that does what you need (assuming you are checking availability, or other dns information), that way you wont have to worry about it.