Exec/Passthru from PHP?

[robpitt]

I gather there are security problems with calling an executable from PHP running as a module.

Can somebody suggest a workarround or alternative for what I'm trying to accomplish...

Specifically I want to code 99% of a page as PHP/HTML and then call a custom executable for a task returning a piece of additional information for display. I don't want to have to code the entire page in CGI.

Any ideas?

Thanks,

Rob

[robpitt]

As an workarround I just tried writing a simple test CGI program in C. This program then called the PHP-CGI executable via a system() call.

Alas whilst working from the shell, it fails to work from the webserver. (Instead it somehow managed to dump the enire PHP ELF format executable to the output stream.)

I wonder is this another unix permissions related thing?

Rob[nbsp][nbsp](unix newbie)

[Arthur]

I wonder is this another unix permissions related thing? No, this is because PHP is running in safe mode, which amongst others means you can't execute external programs.

Arthur

[PaulKroll]

If you have a custom executable that needs to be run, it's gotta be done via CGI. Now, you can run PHP as CGI, by placing the PHP-containing file in the CGI-BIN directory and naming it w/a CGI extension (and inserting the proper shebang & path, the line that looks like "#!/usr/local/bin/php") as the first line of the file. I don't know if you were looking to avoid Perl or looking to avoid the CGI overhead.

The latter isn't possible. Once any part of the script HAS to be CGI, there's no real point in avoiding doing the whole thing as CGI. But you can use PHP for the CGI language if that's what you're familiar with.

(It's also possible that adding the shebang line and giving the file a .cgi extension would work outside of the cgi-bin directory, but I'm not sure of that and there may be permissions changes to consider. I've not done it, so I don't know. :) )

[robpitt]

Thanks for comments folks.

I am aware that I can't run an executable directly from a php script which is running inside apache. My workarround was to write a C++ CGI executable which would do its bit and then spawn the CGI version of PHP to process a php file. Recall the intention was to get PHP and my code running together. Now the C++ CGI works fine so long as I don't do system("/usr/local/bin/php") then it blows up.

Anyware I'm about to play with Pauls shell script idea (this is all very knew to me).

Thanks,

Rob

[robpitt]

Success!

I've created a script staring #!/usr/local/bin/php as you suggested Paul. Sure enough that script can then run the PHP contained within and then the php can in turn call my external command as I orginaly required.

I still have no idea why my orginal C++ compiled CGI blows up in such an interesting fashion when I had it doing a system("PHP") but at least I have a workaround now.

Thanks all,

Rob

PS Why the safe-mode restriction anyway?

[JMT]

Check out http://www.aota.net/ubb/Forum15/HTML/000105-1.html for another way that works quite well.

[robpitt]

That's an elegant looking alternative though I do wonder about the performance hit envolved while the apache webserver establishs a remote HTTP connection to itself.

Okay it seems pretty quick especially if I hardcode the address to my futurequest IP - this will at least save a name lookup.

Thanks,

Rob