Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a simple home web server set up with Apache, but I would rather not have to install and use PHP. I was looking into scripting to deal with the basic dynamic portions of my website. However, I've heard it can be inefficient/unsafe to use bash/shell scripts in the cgi-bin directory for these purposes.

What security risks will I face using bash scripts to process POST data from an input field? What other attacks might I face if I decide to use shell scripts for my website? How can I mitigate these risks?

Is there a better way to safely and efficiently build a dynamic website? Should I not use the cgi-bin directory, and if not, what are the benefits/risks of the alternatives?

share|improve this question
"... using bash scripts to process POST data ..." ... There is not enough snark in the world... – Ignacio Vazquez-Abrams Feb 16 '12 at 3:08
Can you elaborate on why you'd rather do something horridly ill-advised rather than just spending 5 minutes setting up PHP? – ceejayoz Feb 16 '12 at 3:19
Why not save time and post your root password on the web page. In the end it will have about the same effect. – John Gardeniers Feb 16 '12 at 4:13
Haha ok I get the picture. I suspected as much. I don't know why the question was voted down though, especially as this should be a good warning to anyone thinking of trying this (which I haven't- I posted it because there didn't seem to be much material about how stupid this can be). – Dennis Hodapp Feb 16 '12 at 6:16
That will because home web servers are off-topic on ServerFault and some people choose to downvote rather than flag. – Ladadadada Feb 16 '12 at 7:29
up vote 1 down vote accepted

For a serious answer, using shell scripts to parse even the simplest web requests is ill-advised to say the least. Shell script tends to mix up running code and input in too many different ways. The performance for any non-trivial amount of traffic may become a problem, as big scripts usually spawn many subshells and programs.

Furthermore, there are no serious Bash web libraries to speak of.

I recommend using Perl or PHP for that purpose.

share|improve this answer
I can't recommend Perl these days, unless most of the solution already exists and it's just a matter of including the correct library and running one function from it. Although that doesn't necessarily mean that I'd recommend PHP in it's place. – Ignacio Vazquez-Abrams Feb 16 '12 at 5:08

Actually, Openwrt project ( uses in it's "whiterussian" branch (I don't know if it's the case in newer branches) Bash for serving dynamic content (web administration panel). Please remember though that it's firmware for embedded system (Linksys routers) so there is usually no resources (memory) to install anything more sophisticated (PHP).

Also such administration panels are (or at least should be) available only from internal network so the application isn't exposed for public (untrusted) input.

In other cases (especially in PC environment) it's really hard to justify using Bash for serving dynamic web content.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.