What are the potential security risks of using shell_exec in PHP?

Using shell_exec in PHP can pose security risks such as command injection, where an attacker can inject malicious commands into the shell_exec function. To mitigate this risk, it is recommended to use escapeshellarg or escapeshellcmd to sanitize any user input before passing it to shell_exec. 

$user_input = $_POST['user_input'];
$escaped_input = escapeshellarg($user_input);
$output = shell_exec("ls " . $escaped_input);
echo $output;

Keywords

shell_exec security risks PHP command injection vulnerability

Related Questions