Re: [PECL-DEV] safe_shell_exec extension for consideration

Stig Bakken wrote:
> Hi Dave,
> 
> In general, I think calling functions or settings "safe"-anything gives 
> users false fuzzies, and should be avoided.

I'm not concerned with what it's named.  I really just want the 
functionality to exist.  If you wanted to steal from perl, name it 
system() and I'd be just as happy.

> Wouldn't it make more sense 
> to simply extend the existing shell_exec() function in PHP's standard 
> extension to also accept an array parameter?

It's most important to me that I have a way to invoke an external 
program without involving a shell.  The string vs. array issue is 
secondary and only came up after my first iteration of code was already 
complete and I began to use it.

With that in mind, how would you propose that the shell_exec() extension 
work?  If a string is passed, still invoke a shell to avoid breaking all 
the code that's already out there, but avoid the shell if an array is 
passed?  I also considered extending the bypass_shell option to 
proc_open() to work on unix, but that thought took me back to the same 
-- I'd have to add my tokenizing routine back in and a bunch of existing 
code that already uses proc_open() would break.

I'm willing to entertain all suggestions and I'll put some amount of 
effort into providing code to implement whatever the best solution may be.

Thank you,

Dave