Escaping file names?

[laredotornado@zipmail.com]

Hi,

I'm using PHP 5 on Linux. I have a function that checks for file type
by doing the following:

$cmd = "file $p_input_file";
exec("$cmd 2>&1", $output, $return);

However if the file "$p_input_f ile" contains spaces, the command
doesn't work properly (I would need to insert a "\" before the space
for it to work). I figure there are probably some other characters in
the file name that would screw up the command. Is there a predefined
way of escaping the file names or do I need to just do a generic
search and replace on all the special characters I can think of?

Thanks, - Dave

[Hans-Werner Hilse]

Re: Escaping file names?

Hi,

laredotornado@z ipmail.com wrote:

$cmd = "file $p_input_file";
exec("$cmd 2>&1", $output, $return);
>
However if the file "$p_input_f ile" contains spaces, the command
doesn't work properly (I would need to insert a "\" before the space
for it to work). I figure there are probably some other characters in
the file name that would screw up the command. Is there a predefined
way of escaping the file names or do I need to just do a generic
search and replace on all the special characters I can think of?

escapeshellarg( ). It's even in the same manual section as exec() :-)


-hwh

[Michael Fesser]

Re: Escaping file names?

..oO(laredotorn ado@zipmail.com )

>I'm using PHP 5 on Linux. I have a function that checks for file type
>by doing the following:
>
$cmd = "file $p_input_file";
exec("$cmd 2>&1", $output, $return);
>
>However if the file "$p_input_f ile" contains spaces, the command
>doesn't work properly (I would need to insert a "\" before the space
>for it to work). I figure there are probably some other characters in
>the file name that would screw up the command. Is there a predefined
>way of escaping the file names or do I need to just do a generic
>search and replace on all the special characters I can think of?

escapeshellarg( )
escapeshellcmd( )

Micha

[laredotornado@zipmail.com]

Re: Escaping file names?

On Aug 4, 9:36 am, Michael Fesser <neti...@gmx.de wrote:

.oO(laredotorn. ..@zipmail.com)
>

I'm using PHP 5 on Linux.  I have a function that checks for file type
by doing the following:

>

               $cmd = "file $p_input_file";
               exec("$cmd 2>&1", $output, $return);

>

However if the file "$p_input_f ile" contains spaces, the command
doesn't work properly (I would need to insert a "\" before the space
for it to work).  I figure there are probably some other characters in
the file name that would screw up the command.  Is there a predefined
way of escaping the file names or do I need to just do a generic
search and replace on all the special characters I can think of?

>
escapeshellarg( )
escapeshellcmd( )
>
Micha

Thanks but I think I'm still doing something wrong. I have

$p_input_file = "/home/me/Toad Getting Started
Guide.pdf";
$cmd = escapeshellcmd( "file $p_input_file") ;
print "cmd: $cmd<BR>\n"; # outputs 'cmd: file /home/
me/Toad Getting Started Guide.pdf'

Shouldn't the command print out as

cmd: file /home/laredotornado/Toad\ Getting\ Started\ Guide.pdf

? - Dave

[=?iso-8859-1?Q?=C1lvaro?= G. Vicario]

Re: Escaping file names?

*** laredotornado@z ipmail.com escribió/wrote (Mon, 4 Aug 2008 12:23:06
-0700 (PDT)):

$p_input_file = "/home/me/Toad Getting Started
Guide.pdf";
$cmd = escapeshellcmd( "file $p_input_file") ;
print "cmd: $cmd<BR>\n"; # outputs 'cmd: file /home/
me/Toad Getting Started Guide.pdf'

Try:

$cmd = 'file ' . escapeshellarg( $p_input_file);


I've never really understood what escapeshellcmd( ) is supposed to do.
Apparently, it tries to prevent user input from doing harm, but it doesn't
care about making the command actually work.



--
-- http://alvaro.es - Álvaro G. Vicario - Burgos, Spain
-- Mi sitio sobre programación web: http://bits.demogracia.com
-- Mi web de humor en cubitos: http://www.demogracia.com
--