How do I correctly pass query parameters through shell_exec in php

Question

I have this statement in a php script:

shell_exec("curl https://$domain/$url.php?importid=$importid&org=$org&t=".urlencode($t)." >> /var/log/bgrd_call.log 2>&1 ");

The nginx/access.log file shows it correctly substitutes all variables with runtime values. However, it only passes the first query parameter and truncates the rest of the line. I know this because whenever I re-arrange the query parameters, the first one shows up in the access.log entry.

First assigning the parameter to a variable and echoing out results in this (cutting off the url portion):

accept_orders.php?importid=268&org=4&t=2023-06-12+14%3A26%3A43 >> /var/log/bgrd_call.log 2>&1

Corresponding access.log entry:

[12/Jun/2023:13:30:04 +0000] "GET /accept_orders.php?importid=268 HTTP/1.1" 200 3943 "-" "curl/7.81.0"

What is the correct way to do this?

Answer 1

The problem you are encountering is likely because of the & character, which has a special meaning on the shell command line.

I suggest wrapping your full URL in escapeshellarg() like so:

$url = "https://$domain/$url.php?importid=$importid&org=$org&t=".urlencode($t);
shell_exec("curl " . escapeshellarg($url) . " >> /var/log/bgrd_call.log 2>&1");