How should I escape this string properly? - php

I'm trying to compile a Sass (.scss) file's contents using shell_exec or exec, not proc_open. Don't ask me why I don't just pass the file itself or use proc_open, the goal here is to pass the contents via stdin, piped with echo.
I think there are some characters in the string that break the command but I can't figure out which. I'm on Ubuntu 14.04, running PHP 5.6 and in this case CLI.
You can run this to see for yourself (will need Ruby and Sass installed):
sudo apt-get install Ruby && sudo gem install sass
<?php
/** Should work with '$large = true' and '$download = false' **/
// to prove that a small file DOES compile via stdin
$large = true;
// to prove that it's compilable as a file, rather than stdin
$download = false;
$domain = "http://test.fhmp.net";
$file = $large ? 'large' : 'small';
// grab a valid .scss file
$input = file_get_contents("$domain/$file.scss");
if($download){
// create temp file
$temp = tempnam(sys_get_temp_dir(), '');
file_put_contents($temp, $input);
// compile temp file
var_dump(shell_exec("sass --scss '$temp' 2>&1"));
// delete temp file
#unlink($temp);
} else {
// attempt to escape it
$esc = escapeshellarg($input);
// dump the results of the shell call
var_dump(shell_exec("echo $esc | sass --scss --stdin 2>&1"));
}

You should try :
$esc = '$'.escapeshellarg($input);
the escapeshellarg() function escapes single quotes with a backslash which means that:
escapeshellarg("//where's the quote") become 'where\'s the quote'. You can not echo single quotes inside single quotes in the (bash) shell, see: How to escape a single quote in single quote string in Bash?

I think the problem here was that the command was too long when I'm interpolating the entire input string. The solution is to use proc_open or popen to write to standard input rather than pipe using |.

Related

How to execute shell command and echo multiple lines from PHP?

Re,
I use a shell command cat to dump multiple lines into a file like so:
cat > file <<CHAR
one
two
three
CHAR
Here's my problem: I need to execute the same cat command using shell_exec in PHP. How would I dump the contents of an array and terminate the command with CHAR? I know this sounds odd but I need to create a file using sudo and I don't want to dump everything into a temporary file and then sudo cp it to the intended location.
Thanks.
Do it like this:
shell_exec('cat > file <<EOF
foo
bar
EOF
');
Of course this will only work if the underlying shell supports the here-doc syntax.
Use popen() instead of shell_exec():
$filename = 'file';
$text = 'CHAR
one
two
three
';
$cmdline = 'cat > ' . escapeshellarg($filename);
$fp = popen('sudo /bin/sh -c ' . escapeshellarg($cmdline), 'w');
fwrite($fp, $text);
pclose($fp);

Passing a path in a PHP CLI script argument

I'm writing a php CLI script that accepts, among other argument, a path.
So an example is:
php myscript.php -p=/Volumes/Macintosh HD/Users/andrea/samples
The script has his own way to red the arguments and it properly gets the value for -p, setting it in a variable called $project_path.
However, when I test the folder with isdir($project_path) it returns false.
I've tried to pass the path in different ways:
/Volumes/Macintosh\ HD/Users/andrea/samples
'/Volumes/Macintosh HD/Users/andrea/samples'
"/Volumes/Macintosh HD/Users/andrea/samples"
'/Volumes/Macintosh\ HD/Users/andrea/samples'
"/Volumes/Macintosh\ HD/Users/andrea/samples"
Non of them works.
What's the format I must use to make it work?
Please consider that the script must also work on different OS (i.e. Windows).
The problem is the path argument is automatically escaped:
I need to unescape it.
The returned string is:
\'/Volumes/Macintosh\ HD/Users/andrea/samples\'
Short answer: Use escapeshellarg()
Long answer:
chmod +x yourscript.php
-
$path = '/Volumes/Macintosh HD/Users/andrea/samples';
$cmdline = sprintf('/home/user/yourscript.php -p=%s 2>&1', escapeshellarg($path));
$output = shell_exec($cmdline);
Example cli script:
#!/usr/bin/php
<?php
fwrite(STDOUT, print_r($_SERVER, TRUE));
exit(0); // exit with exit code 0
?>
I eventually used the getopt() to get unescaped arguments (I don't know why there is this difference) and str_replace( array( "'", '"'), '', $file_path ); to remove the wrapping quotes.

Bash script to alter serialized PHP data

I have many files containing php serialized data in which I have to replace some strings by another one. The linux host doesn't have any php installed. The problem is to adjust the modified string to correct size.
I tried something like to replace /share path to /opt:
sed -re 's~s:([0-9]+):"/share([^"]*)~s:int(\1-2):/opt\2~g' file
but the result file is bad: lengths are litteral expression int(size - 2)
Any idea ?
This solution isn't ideal, but you could use perl:
my $line;
while ($line = <STDIN>) {
$line =~ s~s:([0-9]+):"/share([^"]*)~"s:".($1-2).":\"/opt$2"~ge;
print $line;
}
Hopefully I've understood your requirements correctly. Here's an example:
php -r 'echo serialize(array("/share/foo")) . "\n";'
a:1:{i:0;s:10:"/share/foo";}
php -r 'echo serialize(array("/share/foo")) . "\n";' | perl replace.pl
a:1:{i:0;s:8:"/opt/foo";}
EDIT: Here's a modified script to edit the file in-place with variable search and replace strings.

piping data into command line php?

It is possible to pipe data using unix pipes into a command-line php script? I've tried
$> data | php script.php
But the expected data did not show up in $argv. Is there a way to do this?
PHP can read from standard input, and also provides a nice shortcut for it: STDIN.
With it, you can use things like stream_get_contents and others to do things like:
$data = stream_get_contents(STDIN);
This will just dump all the piped data into $data.
If you want to start processing before all data is read, or the input size is too big to fit into a variable, you can use:
while(!feof(STDIN)){
$line = fgets(STDIN);
}
STDIN is just a shortcut of $fh = fopen("php://stdin", "r");.
The same methods can be applied to reading and writing files, and tcp streams.
As I understand it, $argv will show the arguments of the program, in other words:
php script.php arg1 arg2 arg3
But if you pipe data into PHP, you will have to read it from standard input. I've never tried this, but I think it's something like this:
$fp = readfile("php://stdin");
// read $fp as if it were a file
If your data is on one like, you can also use either the -F or -R flag (-F reads & executes the file following it, -R executes it literally) If you use these flags the string that has been piped in will appear in the (regular) global variable $argn
Simple example:
echo "hello world" | php -R 'echo str_replace("world","stackoverflow", $argn);'
You can pipe data in, yes. But it won't appear in $argv. It'll go to stdin. You can read this several ways, including fopen('php://stdin','r')
There are good examples in the manual
This worked for me:
stream_get_contents(fopen("php://stdin", "r"));
Came upon this post looking to make a script that behaves like a shell script, executing another command for each line of the input... ex:
ls -ln | awk '{print $9}'
If you're looking to make a php script that behaves in a similar way, this worked for me:
#!/usr/bin/php
<?php
$input = stream_get_contents(fopen("php://stdin", "r"));
$lines = explode("\n", $input);
foreach($lines as $line) {
$command = "php next_script.php '" . $line . "'";
$output = shell_exec($command);
echo $output;
}
If you want it to show up in $argv, try this:
echo "Whatever you want" | xargs php script.php
That would covert whatever goes into standard input into command line arguments.
Best option is to use -r option and take the data from the stdin. Ie I use it to easily decode JSON using PHP.
This way you don't have to create physical script file.
It goes like this:
docker inspect $1|php -r '$a=json_decode(stream_get_contents(STDIN),true);echo str_replace(["Array",":"],["Shares"," --> "],print_r($a[0]["HostConfig"]["Binds"],true));'
This piece of code will display shared folders between host & a container.
Please replace $1 by the container name or put it in a bash alias like ie displayshares() { ... }
I needed to take a CSV file and convert it to a TSV file. Sure, I could import the file into Excel and then re-export it, but where's the fun in that when piping the data through a converter means I can stay in the commandline and get the job done easily!
So, my script (called csv2tsv) is
#!/usr/bin/php
<?php
while(!feof(STDIN)){
echo implode("\t", str_getcsv(fgets(STDIN))), PHP_EOL;
}
I chmod +x csv2tsv.
I can then run it cat data.csv | csv2tsv > data.tsv and I now have my data as a TSV!
OK. No error checking (is the data an actual CSV file?), etc. but the principle works well.
And of course, you can chain as many commands as you need.
If you are wanting more to expand on this idea, then how about the ability to include additional options to your command?
Simple!
#!/usr/bin/php
<?php
$separator = $argv[1] ?? "\t";
while(!feof(STDIN)){
echo implode($separator, str_getcsv(fgets(STDIN))), PHP_EOL;
}
Now I can overwrite the default separator from being a tab to something else. A | maybe!
cat data.csv | csv2tsv '|' > data.psv
Hope this helps and allows you to see how much more you can do!

How do I to properly handle spaces in PHP Shell_exec?

I'm running on win2003 server, PHP 526, via the cmd-line.
I have a cmdline string:
$cmd = ' "d:\Prog Files\foo.exe" -p "d:\data path\datadir" ';
Trying to do this in php code
$out = `$cmd`; # note use of backticks AKA shell_exec
results in a failure by foo.exe as it interprets the -p arg as "d:\data".
However, the same $cdm string copied to the windows shell cmdline executes successfully.
How do I properly handle spaces in PHP shell_exec?
Use escapeshellarg() to escape your arguments, it should escape it with an appropriate combination of quotation marks and escaped spaces for your platform (I'm guessing you're on Windows).
Unlike Unix, which requires quotes within quotes to be escaped, Windows doesn't seem to work this way. How it keeps track of the quotes is beyond me, but this actually seems to work, despite all logic to the contrary:
$cmd = '" "C:\Path\To\Command" "Arg1" "Arg2" "';
$fp = popen($cmd, 'r');
$output='';
while ($l = fgets($fp, 1024))
$output.=$l;
I'm guessing command.exe is taking the command string total and nixing the (otherwise redundant) outside quotes. Without these outside quotes, DOS does some weird things. This solution is similar to post by user187383, but does away with the "cmd /c" which only obfuscates what's actually happening along with a mild performance cut, since cmd /c is implicit by the shell call in the first place!
This is an interesting problem. Apparently, PHP lets you put double quotes around the program or the arguments, but not both. It may be worth reporting this as a bug.
A work around is to use the DOS 8.3 name instead of quotes. E.g., "C:\Program Files\" usually becomes "C:\Progra~1".
Had this problem too - came up with an idea to route the launching through cmd.exe. The trick here is not to get lost in the double qoutes. Generally you want to put anything you want to run in:
exec('cmd /c " '.$path.' "';
Where $path is a already double-quoted path to your executable. Example:
$path = '"C:\Program Files\ToDoList Simple\ToDoList.exe" "C:\SomePath\todo.tdl" -nt test -cm test2';

Categories