in reply to Find the permission problem
Let's say you were going to run an ls command and use the results, and the user can pass switches through. (ls is an impractical example, but good for demonstrating) You could have:
And if the user entered "--sort=size" that would pass through just fine. But what if the user entered "; rm -rf /*" ? Oops.# $options is whatever the user entered. system ("ls $options");
The list syntax to system() prevents this sort of abuse, and that's why it's "better", not from a "getting it to work" standpoint, but from a security viewpoint.
|
|---|