mirror of
https://github.com/fofolee/uTools-Manuals.git
synced 2025-06-18 05:26:57 +08:00
141 lines
5.7 KiB
HTML
141 lines
5.7 KiB
HTML
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
|
<html>
|
|
<head>
|
|
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
|
|
<title>shell 元字符转义</title>
|
|
</head>
|
|
<body class="docs"><div id="layout">
|
|
<div id="layout-content"><div id="function.escapeshellcmd" class="refentry">
|
|
<div class="refnamediv">
|
|
<h1 class="refname">escapeshellcmd</h1>
|
|
<p class="verinfo">(PHP 4, PHP 5, PHP 7)</p><p class="refpurpose"><span class="refname">escapeshellcmd</span> — <span class="dc-title">shell 元字符转义</span></p>
|
|
|
|
</div>
|
|
|
|
<div class="refsect1 description" id="refsect1-function.escapeshellcmd-description">
|
|
<h3 class="title">说明</h3>
|
|
<div class="methodsynopsis dc-description">
|
|
<span class="methodname"><strong>escapeshellcmd</strong></span>
|
|
( <span class="methodparam"><span class="type">string</span> <code class="parameter">$command</code></span>
|
|
) : <span class="type">string</span></div>
|
|
|
|
<p class="para rdfs-comment">
|
|
<span class="function"><strong>escapeshellcmd()</strong></span> 对字符串中可能会欺骗
|
|
shell 命令执行任意命令的字符进行转义。
|
|
此函数保证用户输入的数据在传送到
|
|
<span class="function"><a href="exec.html" class="function">exec()</a></span> 或
|
|
<span class="function"><a href="system.html" class="function">system()</a></span> 函数，或者 <a href="language.operators.execution.html" class="link">执行操作符</a> 之前进行转义。
|
|
</p>
|
|
<p class="para">
|
|
反斜线（\）会在以下字符之前插入：
|
|
<em>&#;`|*?~<>^()[]{}$\</em>, <em>\x0A</em>
|
|
和 <em>\xFF</em>。 <em>'</em> 和 <em>"</em>
|
|
仅在不配对儿的时候被转义。
|
|
在 Windows 平台上，所有这些字符以及 <em>%</em> 和 <em>!</em> 字符都会被空格代替。
|
|
</p>
|
|
</div>
|
|
|
|
|
|
<div class="refsect1 parameters" id="refsect1-function.escapeshellcmd-parameters">
|
|
<h3 class="title">参数</h3>
|
|
<p class="para">
|
|
<dl>
|
|
|
|
|
|
<dt>
|
|
<code class="parameter">command</code></dt>
|
|
|
|
<dd>
|
|
|
|
<p class="para">
|
|
要转义的命令。
|
|
</p>
|
|
</dd>
|
|
|
|
|
|
</dl>
|
|
|
|
</p>
|
|
</div>
|
|
|
|
|
|
<div class="refsect1 returnvalues" id="refsect1-function.escapeshellcmd-returnvalues">
|
|
<h3 class="title">返回值</h3>
|
|
<p class="para">
|
|
转义后的字符串。
|
|
</p>
|
|
</div>
|
|
|
|
|
|
<div class="refsect1 examples" id="refsect1-function.escapeshellcmd-examples">
|
|
<h3 class="title">范例</h3>
|
|
<p class="para">
|
|
<div class="example" id="example-4358">
|
|
<p><strong>Example #1 <span class="function"><strong>escapeshellcmd()</strong></span> example</strong></p>
|
|
<div class="example-contents">
|
|
<div class="phpcode"><pre><span style="color: #000000">
|
|
<span style="color: #0000BB"><?php<br /></span><span style="color: #FF8000">// 我们故意允许任意数量的参数<br /></span><span style="color: #0000BB">$command </span><span style="color: #007700">= </span><span style="color: #DD0000">'./configure '</span><span style="color: #007700">.</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'configure_options'</span><span style="color: #007700">];<br /><br /></span><span style="color: #0000BB">$escaped_command </span><span style="color: #007700">= </span><span style="color: #0000BB">escapeshellcmd</span><span style="color: #007700">(</span><span style="color: #0000BB">$command</span><span style="color: #007700">);<br /> <br /></span><span style="color: #0000BB">system</span><span style="color: #007700">(</span><span style="color: #0000BB">$escaped_command</span><span style="color: #007700">);<br /></span><span style="color: #0000BB">?></span>
|
|
</span>
|
|
</pre></div>
|
|
</div>
|
|
|
|
</div>
|
|
</p>
|
|
</div>
|
|
|
|
|
|
<div class="refsect1 notes" id="refsect1-function.escapeshellcmd-notes">
|
|
<div class="warning"><strong class="warning">Warning</strong>
|
|
<p class="para">
|
|
<span class="function"><strong>escapeshellcmd()</strong></span> 应被用在完整的命令字符串上。
|
|
即使如此，攻击者还是可以传入任意数量的参数。
|
|
请使用 <span class="function"><a href="escapeshellarg.html" class="function">escapeshellarg()</a></span> 函数
|
|
对单个参数进行转义。
|
|
</p>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
<div class="refsect1 changelog" id="refsect1-function.escapeshellcmd-changelog">
|
|
<h3 class="title">更新日志</h3>
|
|
<p class="para">
|
|
<table class="doctable informaltable">
|
|
|
|
<thead>
|
|
<tr>
|
|
<th>版本</th>
|
|
<th>说明</th>
|
|
</tr>
|
|
|
|
</thead>
|
|
|
|
<tbody class="tbody">
|
|
<tr>
|
|
<td>5.4.43, 5.5.27, 5.6.11</td>
|
|
<td>
|
|
感叹号会被空格所替换。
|
|
</td>
|
|
</tr>
|
|
|
|
</tbody>
|
|
|
|
</table>
|
|
|
|
</p>
|
|
</div>
|
|
|
|
|
|
<div class="refsect1 seealso" id="refsect1-function.escapeshellcmd-seealso">
|
|
<h3 class="title">参见</h3>
|
|
<p class="para">
|
|
<ul class="simplelist">
|
|
<li class="member"><span class="function"><a href="escapeshellarg.html" class="function" rel="rdfs-seeAlso">escapeshellarg()</a> - 把字符串转码为可以在 shell 命令里使用的参数</span></li>
|
|
<li class="member"><span class="function"><a href="exec.html" class="function" rel="rdfs-seeAlso">exec()</a> - 执行一个外部程序</span></li>
|
|
<li class="member"><span class="function"><a href="popen.html" class="function" rel="rdfs-seeAlso">popen()</a> - 打开进程文件指针</span></li>
|
|
<li class="member"><span class="function"><a href="system.html" class="function" rel="rdfs-seeAlso">system()</a> - 执行外部程序，并且显示输出</span></li>
|
|
<li class="member"><a href="language.operators.execution.html" class="link">执行运算符</a></li>
|
|
</ul>
|
|
</p>
|
|
</div>
|
|
|
|
</div></div></div></body></html> |