1

In our apache error log (/usr/local/apache/logs/error_log) for one of our servers we are seeing a shell command running quite often which is throwing an error, it looks like this:

sh: list_price: command not found

list_price is a field we use in an ecommerce system on over 50 sites and certainly nothing suspicious. The issue is that we have no idea how this is being passed to the shell - we have checked all occurrences of exec() and system() and we just cannot see how this would be getting passed through. Is there any way we can detect more easily what the source of this could be as there is nothing more meaningful being output that what i put above. FYI this is on a server running CentOS 5 and the sites in question are all PHP.

3 Answers 3

7

Backticks ( ` ) have a special meaning in PHP. They are the Execution Operators (sounds grim doesn't it). When used outside a string as a text delimiter, it execute the command between them. For the following example:

$commandResult = `ls -l`;
echo $commandResult; // Will output a directory listing of the current directory

To stop the behaviour, you simply need to put it between single quotes ( ' ) or quotes ( " ):

$commandResult = '`ls -l`';
echo $commandResult; // Will output `ls -l`;

Now, you probably did something as such: (Lazy code below, not safe against sql injection, but is just an example).

$query = 'SELECT * FROM sometable ORDER BY ' . `list_price`;

But forgot to put quotes around it, leading to 2 things:

  • PHP didn't give you a syntax error because it is valid syntax.
  • You get the failed shell command above.

Search your code base for any reference of list_price and make sure it is between single quotes or quotes.

2
  • i didnt know that at all, that has to be it as we have checked all instances of exec. somewhere we must be echoing that value as part of some debugging. thanks!
    – robjmills
    Jun 16, 2009 at 14:19
  • found it, it was a piece of code that looked like this: $checkPrice = ($method == "special") ? special_price : list_price;
    – robjmills
    Jun 16, 2009 at 14:25
2

Are you using backticks around list_price, without quoting them? This could be your problem.

3
  • we are using backticks for all our SQL queries, how can this be a problem?
    – robjmills
    Jun 16, 2009 at 13:39
  • This is interpreted by php as "execute a subshell". you should be using single quotes.
    – Brent
    Jun 16, 2009 at 14:24
  • Slightly misleading answer. Backticks are the correct quote identifier character to be using. They should just be encapsulated correctly.
    – Dan Carley
    Jun 16, 2009 at 14:47
1

You must be overlooking something, no offense meant. Maybe you can try creating the list_price shell script so it can write some logfile as to how and when it was executed?

5
  • none taken, i know this is probably due to an oversight on our behalf. list_price though is just a field in mysql, called like "SELECT list_price FROM products .." etc. I guess somewhere it is passed to a command as a variable. we just cant seem to track down where
    – robjmills
    Jun 16, 2009 at 13:35
  • we do use backticks for all fieldnames/table names in our SQL
    – robjmills
    Jun 16, 2009 at 13:48
  • as wzzrd says, try to write a list_price script that write ENV variable to a log file and also print argument received
    – radius
    Jun 16, 2009 at 14:01
  • i'm not sure if i'm confused or whether my question was confused. list_price is not nor should be a shell script. It is simply the output of a variable used across various php scripts. a few of these scripts use exec() to execute shell commands for things like imagemagick. somehow and somewhere the word "list_price" is being passed to the shell and is failing (as we would expect) as it its an invalid command. not sure how writing a shell script can help this?
    – robjmills
    Jun 16, 2009 at 14:13
  • I understand that, but you would make a shellscript called list_price, it would get called by your PHP app and that would enable you to have it print or log some stuff by which you could possible identify the problem area in your code. :p
    – wzzrd
    Jun 16, 2009 at 20:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .