Command injection: from input to shell

January 9, 2026 · 1 min read · #web #command-injection #rce

When the app builds a shell command with unvalidated input, shell metacharacters become code:

system("ping -c 1 " . $_GET['host']);
// host = 8.8.8.8; cat /etc/passwd

;, |, &&, $(...), backticks: all separate or inject commands. Even blind, ; sleep 5 or DNS/HTTP exfiltration confirms execution.

Defence

Avoid the shell: use APIs that take arguments as an array (execve-style, subprocess.run([...], shell=False)), so input is an argument, not code. If the shell is truly needed, validate with strict whitelists. Escaping (escapeshellarg) is the last resort, easy to get wrong.

« back to home