Escaping file names?

[laredotornado]

Hi,

I'm using PHP 5 on Linux. I have a function that checks for file type
by doing the following:

$cmd = "file $p_input_file";
exec("$cmd 2>&1", $output, $return);

However if the file "$p_input_file" contains spaces, the command
doesn't work properly (I would need to insert a "\" before the space
for it to work). I figure there are probably some other characters in
the file name that would screw up the command. Is there a predefined
way of escaping the file names or do I need to just do a generic
search and replace on all the special characters I can think of?

Thanks, - Dave

[Hans-Werner Hilse]

Hi,

la***********@zipmail.com wrote:

$cmd = "file $p_input_file";
exec("$cmd 2>&1", $output, $return);

However if the file "$p_input_file" contains spaces, the command
doesn't work properly (I would need to insert a "\" before the space
for it to work). I figure there are probably some other characters in
the file name that would screw up the command. Is there a predefined
way of escaping the file names or do I need to just do a generic
search and replace on all the special characters I can think of?

escapeshellarg(). It's even in the same manual section as exec() :-)
-hwh

[Michael Fesser]

..oO(la***********@zipmail.com)

>I'm using PHP 5 on Linux. I have a function that checks for file type
by doing the following:

$cmd = "file $p_input_file";
exec("$cmd 2>&1", $output, $return);

However if the file "$p_input_file" contains spaces, the command
doesn't work properly (I would need to insert a "\" before the space
for it to work). I figure there are probably some other characters in
the file name that would screw up the command. Is there a predefined
way of escaping the file names or do I need to just do a generic
search and replace on all the special characters I can think of?

escapeshellarg()
escapeshellcmd()

Micha

[laredotornado]

On Aug 4, 9:36*am, Michael Fesser <[e-mail]:

.oO([e-mail])

I'm using PHP 5 on Linux. *I have a function that checks for file type
by doing the following:

* * * * * * * *$cmd = "file $p_input_file";
* * * * * * * *exec("$cmd 2>&1", $output, $return);

However if the file "$p_input_file" contains spaces, the command
doesn't work properly (I would need to insert a "\" before the space
for it to work). *I figure there are probably some other characters in
the file name that would screw up the command. *Is there a predefined
way of escaping the file names or do I need to just do a generic
search and replace on all the special characters I can think of?

escapeshellarg()
escapeshellcmd()

Micha

Thanks but I think I'm still doing something wrong. I have

$p_input_file = "/home/me/Toad Getting Started
Guide.pdf";
$cmd = escapeshellcmd("file $p_input_file");
print "cmd: $cmd<BR>\n"; # outputs 'cmd: file /home/
me/Toad Getting Started Guide.pdf'

Shouldn't the command print out as

cmd: file /home/laredotornado/Toad\ Getting\ Started\ Guide.pdf

? - Dave

[=?iso-8859-1?Q?=C1lvaro?= G. Vicario]

*** la***********@zipmail.com escribió/wrote (Mon, 4 Aug 2008 12:23:06
-0700 (PDT)):

$p_input_file = "/home/me/Toad Getting Started
Guide.pdf";
$cmd = escapeshellcmd("file $p_input_file");
print "cmd: $cmd<BR>\n"; # outputs 'cmd: file /home/
me/Toad Getting Started Guide.pdf'

Try:

$cmd = 'file ' . escapeshellarg($p_input_file);
I've never really understood what escapeshellcmd() is supposed to do.
Apparently, it tries to prevent user input from doing harm, but it doesn't
care about making the command actually work.

--
-- http://alvaro.es - Álvaro G. Vicario - Burgos, Spain
-- Mi sitio sobre programación web: http://bits.demogracia.com
-- Mi web de humor en cubitos: http://www.demogracia.com
--