GCIH · Question #44
Which of the following functions can be used as a countermeasure to a Shell Injection attack? Each correct answer represents a complete solution. Choose all that apply.
The correct answer is A. escapeshellarg() D. escapeshellcmd(). Shell injection attacks are mitigated by sanitizing input passed to shell commands using PHP's escapeshellarg() and escapeshellcmd() functions. These two functions sanitize different parts of a shell call - arguments and the command itself - providing complete protection…
Question
Which of the following functions can be used as a countermeasure to a Shell Injection attack? Each correct answer represents a complete solution. Choose all that apply.
Options
- Aescapeshellarg()
- Bmysql_real_escape_string()
- Cregenerateid()
- Descapeshellcmd()
How the community answered
(28 responses)- A86% (24)
- B11% (3)
- C4% (1)
Why each option
Shell injection attacks are mitigated by sanitizing input passed to shell commands using PHP's escapeshellarg() and escapeshellcmd() functions. These two functions sanitize different parts of a shell call - arguments and the command itself - providing complete protection against shell metacharacter injection.
escapeshellarg() wraps a string in single quotes and escapes any existing single quotes, ensuring that user-supplied input is treated as a single safe argument rather than being interpreted as shell metacharacters or additional commands.
mysql_real_escape_string() is a MySQL-specific function designed to prevent SQL injection by escaping special characters for database queries; it provides no protection against OS shell injection.
regenerateid() is not a standard PHP function; session_regenerate_id() is used to prevent session fixation attacks and has no relevance to shell injection countermeasures.
escapeshellcmd() escapes shell metacharacters (such as &, |, ;, $) within the command string itself, preventing attackers from injecting additional commands or operators into the shell command being executed.
Concept tested: PHP shell injection prevention with escapeshellarg and escapeshellcmd
Source: https://www.php.net/manual/en/function.escapeshellarg.php
Topics
Community Discussion
No community discussion yet for this question.