Windows Process Execution on PHP with Double Quotes
Posted on 2009-01-19 • (0)
I had a so-called “poll” on Win32 PHP (chinese only), which actually was simply a nag of problems writing code on PHP with cross-platform support (Windows and Linux are in my mind), especially when dealing with file system and command execution — without telling in detail. The complaint had been well hidden in another blog post, but since I don’t want to dive into unconstructive criticism, I just refrain from posting the whole thing here without digging into detail. Until now. That’s lucky, as some more information is revealed, and the situation is not as crappy as I expected. Here goes the first one.
Problem executing commands with more than 2 double quotes
The most frequently used command execution functions in PHP include exec(), system() and so on. They have a common problem: no more than 2 double quotes allowed. For example:
<?php system('"C:\Program Files\ImageMagick\display.exe" "C:\Document and Settings\user\Great Pic.jpg"'); ?>
Such commands are actually pretty common, with space in program path as well as arguments that followed. Regardless of program execution privilege or whatever, the system() itself already fails.
People used to know this for 2 years or more, yet no cure exists. Funny schemes were invented to circumvent such problem, there are at least 2 on PHP website comments:
[......]
Pwnie award
Posted on 2008-08-22 • (1)
真是不知這個用中文怎樣說,「千瘡百孔泛黑大獎」也不足言其英文含意之萬一。給 WordPress 的這個獎姍姍遲來,對我而言有點遲過頭了,雖然總好過沒有。但頒這個獎也是實情。君不見在 SecurityFocus 個個星期它都榜上有名!還要個個大鑊,即使不是 WordPress 本身,也是一些很多人用的[......]
近期看到的所謂 “Web Attack”
Posted on 2008-08-07 • (0)
這一兩星期經常看到 Apache log 中出現和 remote file inclusion 有關的「攻擊」,一時好奇,抓其中一個檔案來看一看,赫然發現並不是盲目直接攻擊,反而像大量搜集伺服器資料。拿其中一個看到的檔案為例:
[......]
在 Ubuntu 寫 shell script 也不容易
Posted on 2007-06-16 • (12)
PHP 安全性雜談
Posted on 2007-01-08 • (0)

今天整天都在更新和 PHP 有關的東西:
- 因為看到 Wordpress 2.0.4 有些嚴重安全漏洞 [1] [2],而且都是可以行使 admin 權力執行任意的 php code,所以更新至最新的 2.0.6。
- 安裝 (Continue reading…)
Machine is up again
Posted on 2006-01-03 • (0)
Finally, my machine is back after replacing harddisk (which is reached its normal life cycle) with a new one. I end up installing Ubuntu after a serie[......]