0

I am using shell_exec function on the following variables to execute commands on the shell:

  1. fname (characters only)
  2. fpack(characters only)
  3. email (a valid email address)

My code is:

<?php

require_once 'connectionToDB.php';

$fname = mysqli_real_escape_string($dbc, filter_var(escapeshellarg($_POST['fname']), FILTER_SANITIZE_STRING));
$fpack = mysqli_real_escape_string($dbc, filter_var(escapeshellarg($_POST['fpack']), FILTER_SANITIZE_STRING));
$email = mysqli_real_escape_string($dbc, filter_var(escapeshellarg($_POST['email']), FILTER_SANITIZE_EMAIL));

/** Verify name of applicaion **/
if(!ctype($fname)) {
    $op = json_encode(array('type' => 'error', 'msg' => 'Application name must be in english alphabetical letters only'));
    die($op);
}
if(strlen($fname)>20) {
    $op = json_encode(array('type' => 'error', 'msg' => 'Application name must be less than 20 characters'));
    die($op);
}

/** Verify name of package **/
if(!ctype($fpack)) {
    $op = json_encode(array('type' => 'error', 'msg' => 'Package name must be in english alphabetical letters only'));
    die($op);
}
if(strlen($fpack)>20) {
    $op = json_encode(array('type' => 'error', 'msg' => 'Package name must be less than 20 characters'));
    die($op);
}

/** Verify user's email **/
if (strlen($email)>50) {
    $op = json_encode(array('type' => 'error', 'msg' => 'Email must be of less than 50 characters'));
    die($op);
}

if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    $op = json_encode(array('type' => 'error', 'msg' => 'Please provide a valid email address.'));
    die($op);
}

As I said I am using shell_exec on these variables, I am scared of remote code execution. Is my code safe enough to prevent RCE?

4
  • There is no ctype function in standard PHP. Is it a custom function?
    – Gumbo
    Feb 25, 2015 at 17:32
  • Generally, you have to differentiate between the data validation according to your data model (e. g., email should only be a valid e-mail address) and the proper handling of the data during processing (e. g., proper quoting/escaping command line parameters). These are two absolutely different and independent steps. You’re mixing them together.
    – Gumbo
    Feb 25, 2015 at 17:41
  • Same question on Security Stack Exchange
    – Gumbo
    Feb 25, 2015 at 17:43
  • I'm voting to close this question as off-topic because it's a duplicate of security.stackexchange.com/a/82521/43688 Oct 4, 2018 at 5:55

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.