Click here to get back home

Escaping file names?
 Home | NewsGroups | Search | About
Login Password
Register Now! Lost Password?
 comp.lang.php    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Escaping file names? laredotornado@zipmail.com 08-04-2008
Get Chitika Premium
Posted by laredotornado@zipmail.com on August 4, 2008, 10:24 am
Please log in for more thread options
 Hi,

I'm using PHP 5 on Linux. I have a function that checks for file type
by doing the following:

$cmd = "file $p_input_file";
exec("$cmd 2>&1", $output, $return);

However if the file "$p_input_file" contains spaces, the command
doesn't work properly (I would need to insert a "\" before the space
for it to work). I figure there are probably some other characters in
the file name that would screw up the command. Is there a predefined
way of escaping the file names or do I need to just do a generic
search and replace on all the special characters I can think of?

Thanks, - Dave

Posted by Hans-Werner Hilse on August 4, 2008, 11:10 am
Please log in for more thread options
 Hi,

laredotornado@zipmail.com wrote:

> $cmd = "file $p_input_file";
> exec("$cmd 2>&1", $output, $return);
>
> However if the file "$p_input_file" contains spaces, the command
> doesn't work properly (I would need to insert a "\" before the space
> for it to work). I figure there are probably some other characters in
> the file name that would screw up the command. Is there a predefined
> way of escaping the file names or do I need to just do a generic
> search and replace on all the special characters I can think of?

escapeshellarg(). It's even in the same manual section as exec() :-)


-hwh

Posted by Michael Fesser on August 4, 2008, 11:36 am
Please log in for more thread options
.oO(laredotornado@zipmail.com)

>I'm using PHP 5 on Linux. I have a function that checks for file type
>by doing the following:
>
> $cmd = "file $p_input_file";
> exec("$cmd 2>&1", $output, $return);
>
>However if the file "$p_input_file" contains spaces, the command
>doesn't work properly (I would need to insert a "\" before the space
>for it to work). I figure there are probably some other characters in
>the file name that would screw up the command. Is there a predefined
>way of escaping the file names or do I need to just do a generic
>search and replace on all the special characters I can think of?

escapeshellarg()
escapeshellcmd()

Micha

Posted by laredotornado@zipmail.com on August 4, 2008, 3:23 pm
Please log in for more thread options
> .oO(laredotorn...@zipmail.com)
>
> >I'm using PHP 5 on Linux. =A0I have a function that checks for file type
> >by doing the following:
>
> > =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0$cmd =3D "file $p_input_file";
> > =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0exec("$cmd 2>&1", $output, $return);
>
> >However if the file "$p_input_file" contains spaces, the command
> >doesn't work properly (I would need to insert a "\" before the space
> >for it to work). =A0I figure there are probably some other characters in
> >the file name that would screw up the command. =A0Is there a predefined
> >way of escaping the file names or do I need to just do a generic
> >search and replace on all the special characters I can think of?
>
> escapeshellarg()
> escapeshellcmd()
>
> Micha

Thanks but I think I'm still doing something wrong. I have

$p_input_file =3D "/home/me/Toad Getting Started
Guide.pdf";
$cmd =3D escapeshellcmd("file $p_input_file");
print "cmd: $cmd<BR>\n"; # outputs 'cmd: file /home/
me/Toad Getting Started Guide.pdf'

Shouldn't the command print out as

cmd: file /home/laredotornado/Toad\ Getting\ Started\ Guide.pdf

? - Dave

Posted by =?iso-8859-1?Q?=C1lvaro?= G. V on August 5, 2008, 1:58 pm
Please log in for more thread options
*** laredotornado@zipmail.com escribió/wrote (Mon, 4 Aug 2008 12:23:06
-0700 (PDT)):
> $p_input_file = "/home/me/Toad Getting Started
> Guide.pdf";
> $cmd = escapeshellcmd("file $p_input_file");
> print "cmd: $cmd<BR>\n"; # outputs 'cmd: file /home/
> me/Toad Getting Started Guide.pdf'

Try:

$cmd = 'file ' . escapeshellarg($p_input_file);


I've never really understood what escapeshellcmd() is supposed to do.
Apparently, it tries to prevent user input from doing harm, but it doesn't
care about making the command actually work.



--
-- http://alvaro.es - Álvaro G. Vicario - Burgos, Spain
-- Mi sitio sobre programación web: http://bits.demogracia.com
-- Mi web de humor en cubitos: http://www.demogracia.com
--

Similar ThreadsPosted
How unique is temporary file names (from file upload)? January 10, 2008, 10:56 am
File Names Into Array February 14, 2005, 6:12 am
quotes in file names September 7, 2006, 2:27 am
Problem Passing File Names March 26, 2006, 2:36 pm
Write custom column names to query result file May 3, 2005, 12:42 pm
Storing form field names in an array and writing values to a text file July 15, 2004, 6:36 pm
Escaping April 10, 2008, 3:44 pm
Escaping for PHP and MySQL August 9, 2007, 6:42 am
Escaping SQLite October 1, 2007, 1:52 am
escaping characters in php and mysql - help August 23, 2004, 1:25 am

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap