How to use Execution Operators in PHP

There is more to PHP than most people might think, it evolved from its original routes of being a procedural programming language and is now much more. One of the features PHP offers is support for the use of execution operators within code. This means you can run system-level command line-style actions directly from PHP. This is similar to other programming languages and with PHP there are even multiple ways to run shell commands. Let's explore how you can run shell commands directly for your PHP code.

Why run shell commands with PHP?

There are many use cases for running shell commands with PHP. It could be that PHP doesn't offer native support for a task that you're trying to complete on your operating system. Maybe, at the time of writing your PHP code, there wasn't a pre-built function or way to do it without running a shell command directly. Another possibility is that the task at hand could be performed quicker (and created faster) compared to writing the equivalent PHP code.

Execution Operators in PHP

When writing PHP code there are some characters that the parsing engine will treat differently than others. One of the main characters PHP uses is the dollar sign, which developers use to specify what are variables within the code. Another character (or set of characters) that PHP treats in a special case is backticks. When the parsing engine comes across a pair of backticks, PHP will interpret and attempt to run the contents of it as a shell command on your operating system. When referring to backticks, remember these are not single quotes characters. An example of backticks is as follows.

# Pair of backticks
` `

Once the contents of the backticks have run, the result of the shell command is returned. This is one of the main reasons developers choose execution operators in PHP code because instead of dumping the output directly once run, it's returned.

# Example shell command
`less /var/log/access_log`

The execution operators in PHP work and have the same behavior as the shell_exec function in PHP, where it's possible to run a shell command within PHP, following the same return syntax, where it's returned compared to the exec function PHP which is dumped directly out.

It's important to note that on a higher PHP level, if shell_exec has been disabled, backtick shell interpretation will also be disabled.

How to check if shell_exec is disabled

If shell_exec and backtick execution operators aren't working in your PHP code, it's likely that for security the option to allow these to run has been disabled. You can quickly run a check within your PHP code to see if the function exists, using the PHP method; "function_exitsts". By passing the "shell_exec" name to this function it will return a boolean based on the provided function that is available to us within PHP. If it returns false, that means it's been disabled.

# Check 
if (function_exists('shell_exec')) {
 echo 'shell_exec not disabled!';
}

Execution Operators Examples

Let's explore a few ways in which we can use execution operators in PHP to run command-line-level operations on our servers. Whilst PHP offers a lot of common functions out of the box, sometimes you may need to perform an operation that isn't available from PHP natively.

In our first example, we are using the program "ping" to network ping the provided website. Ping can accept command line level options one of which is "-c". This option tells ping to stop after N times. In our case, that's four.

$ping_result = `ping -c 4 example.com`;
echo $ping_result;

In our next example, because PHP does not have direct access to hardware devices, such as USB devices, we may need to obtain information about what is connected to the machine. Therefore we would have to use a utility such as "lsusb" (if on Linux) to provide information about USB buses and what's connected to them. Or maybe we've created a wrapper for the networking stack and want to view the server's current firewall settings. For that, on a Linux machine, we can use "iptables".

// List connected USB devices
$usb_devices = `lsusb`;

// Listing firewall rules
$firewall_rules = `sudo iptables -L`;

There are also times when native PHP extensions don't cover what we need to do. One example of that is when using a third-party piece of software called ImageMagick. ImageMagick is an open-source and cross-platform software suite for displaying, creating, and converting images of all different formats. It is so popular, that PHP has its own native PHP extension which uses the ImageMagick API. However, not all options available from the CLI are possible via the PHP extension. Therefore we may be required to run some commands using execution operators in PHP. Here is an example of passing in a PNG and converting it to a WebP image.

magick test.png -quality 80 test.webp

Conclusion

Execution operators in PHP are a great way to extend functionality outside of the PHP codebase. This is especially helpful if, for example, you need to run an external program to complete a task. That could be a DIG (Domain Information Groper) lookup on a domain from nameservers, domain WHOIS lookup, or view a log outside of PHP's open_basedir restriction.

• Anything in ` ` backticks, PHP will attempt to run as a shell command on the server
• The output will be returned instead of directly outputted to the screen
• Both backticks or shell_exec have the same desired effect
• If commands aren't running in backticks check if shell_exec has been disabled for security
• Be careful running such commands to avoid security vulnerabilities such as command injection