Hacker News Reader

As far as I can tell, PHP doesn't have any way to spawn a subprocess without passing it to /bin/sh for evaluation.

PHPMailer (not core php) apparently either calls php's popen(), which passes to the shell...or calls php's mail(), which uses popen(). There are other options in php, like proc_open(), but they also call /bin/sh.

TLDR: There isn't any way in PHP to avoid "relying on the shell to separate options for you".

View on HN

It's possible with pcntl_fork() and pcntl_exec() but that's not compatible with apache's mod_php which is probably still pretty widely used even though it's getting replaced by php-fpm.

I believe many distributions disable pcntl_* functions even in a php-fpm environment. You can make it work, of course, but it's not the default.

I've read reports on the incompatibilities, but the odd part is that you can popen which, under FreeBSD at least, is a fairly thin wrapper around vfork() and execve() makes that feel suspect. It may be a bit more work, but commands like this still should be treated as special.

Reply on news.ycombinator.com