How to test a PHP shell exec script

It can be tricky testing a PHP script that is executing shell commands via the shell_exec() or exec() methods. The PHP script runs as the Apache user, while you may be logged in as root on the server. Running these shell commands as the Apache user may show different results from your current logged in user. As an example – a root user would have no problems executing commands, while the Apache user (typically: www-data) would.

Note that the www-data user does not have root privileges, and for a good reason too! Your PHP script may request a password to execute specific scripts or Linux commands.ย  The shell_exec() result string, in this case, is “sudo: no tty present and no askpass program specified”. A Future post will explain how to get around this the safe way.

If you have access to the Linux server:

Enter the following commands via SSH to log in as the Apache www-data user on your Linux box:

  • sudoย su -s /bin/bash www-data

You should now have temporary access as the www-data user and can now test the shell commands executed by the www-data user.

Type “exit” when you are ready to return to your logged in user.

Alternatively, preferably and if you don’t have access to the Linux server โ€“

Create the PHP script and execute it via the browser. I find this method much easier!

The following script lets you identify the current Apache user. We are assuming the Apache user is www-data, but it could be something else also.

It also does a couple of tests on the shell execution response to determine if an error occurred. Note: there are better ways to determine the exit code of an executed shell command. Read my article “How to execute shell commands via PHP” and refer to the PHP exec() method.

Example shell_exec() script:

//identify the current user
echo("<p>CURRENT_USER: ".shell_exec( 'whoami' )."</p>");

//execute the shell command
$exec = "sudo /path/to/my/script/ awesomepigs iggitypiggity";
$shell_result = shell_exec($exec." 2>&1");

//assume no error occurred while executing the PHP script
$shell_error = false;

//test for common keywords if an error occurred
if (strpos(strtolower($shell_result),"cannot") !== false) {
$shell_error = true;
if (strpos(strtolower($shell_result),"invalid") !== false) {
$shell_error = true;
if (strpos(strtolower($shell_result),"authentication") !== false) {
$shell_error = true;
if (strpos(strtolower($shell_result),"failed") !== false) {
$shell_error = true;
if (strpos(strtolower($shell_result),"systemctl status ") !== false) {
$shell_error = true;
if (strpos(strtolower($shell_result),"denied") !== false) {
$shell_error = true;
if (strpos(strtolower($shell_result),"try again later") !== false) {
$shell_error = true;

//return the results to the browser
echo("<p>SHELL_ERROR = ".$shell_error."</p>");
echo("<p>SHELL_RESULT:<BR> ".str_replace("\n", "<BR>", $shell_result)."</p>");


2 Comments on “How to test a PHP shell exec script”

  1. Hi there to all, how is the whole thing, I think every one is
    getting more from this web page, and your views are fastidious designed for new viewers.

  2. I’m impressed, I must say. Seldom do I encounter a blog that’s both educative and
    engaging, and let me tell you, you have hit the nail on the
    head. The issue is something which not enough people are speaking intelligently about.
    I am very happy that I came across this during my search for something concerning this.

Leave a Reply

Your email address will not be published. Required fields are marked *