GCIH · Question #53
Which of the following functions can you use to mitigate a command injection attack? Each correct answer represents a part of the solution. Choose all that apply.
The correct answer is A. escapeshellarg() B. escapeshellcmd(). PHP provides escapeshellarg() and escapeshellcmd() to sanitize user input before it is passed to shell commands, directly mitigating command injection. Functions like htmlentities() and strip_tags() address HTML/XSS vulnerabilities, not shell injection.
Question
Which of the following functions can you use to mitigate a command injection attack? Each correct answer represents a part of the solution. Choose all that apply.
Options
- Aescapeshellarg()
- Bescapeshellcmd()
- Chtmlentities()
- Dstrip_tags()
How the community answered
(26 responses)- A96% (25)
- C4% (1)
Why each option
PHP provides escapeshellarg() and escapeshellcmd() to sanitize user input before it is passed to shell commands, directly mitigating command injection. Functions like htmlentities() and strip_tags() address HTML/XSS vulnerabilities, not shell injection.
escapeshellarg() wraps a string in single quotes and escapes any existing single quotes within it, ensuring user-supplied input is treated as a literal shell argument rather than executable shell code.
escapeshellcmd() escapes shell metacharacters such as &, ;, |, and * in a command string, preventing user input from being interpreted as additional shell commands or operators.
htmlentities() converts special characters to their HTML entity equivalents, which protects against Cross-Site Scripting (XSS) in HTML output but has no effect on how the shell parses commands.
strip_tags() removes HTML and PHP tags from a string to defend against tag-based XSS injection in web output, and provides no protection against shell metacharacter abuse in command injection scenarios.
Concept tested: PHP shell sanitization functions for command injection prevention
Source: https://www.php.net/manual/en/function.escapeshellarg.php
Topics
Community Discussion
No community discussion yet for this question.