How to use exec shell with PHP and MySQL?

问题:

I want to use an exec shell in PHP code by connecting to a database. I had used this block of code but it doesn't work! I don't know what might be the problem, so this is my code:

if(isset($_POST['submit4']))

{
$results = shell_exec("cat /var/log/apache2/access.log | grep" . $_POST['key'] . "| sed s/'^.*apache2'/''/g | sort | uniq -c | sort -nr | cat ");
echo $results ;

}

else if(isset($_POST['submit5']))
{
mysql_connect('127.0.0.1',"root"," ") or die("erreur de connexion au serveur");
    mysql_select_db("lastnline");
        $sql='Select * from motclef';    
    $res=mysql_query($sql);
           while($row=mysql_fetch_array($res))

    {
$results = shell_exec("cat /var/log/apache2/access.log | grep" . $row['nom'] . "| sed s/'^.*apache2'/''/g | sort | uniq -c | sort -nr | cat ");
echo $results ;

    }       
}

The submit4 works very good but the submit5 doesn't work :/

回答1:

But never populate input values directly into a shell command. Use the function escapeshellarg():

$key = escapeshellarg($_POST['key']);