exec() in php script not working

magicalshashank31 · 12-24-2011, 01:37 AM

i have made postfix mailserver in centos6 and i want to send and receive mails via webpage , first i made a html page to create users :

Code:

<html>
<body>

<form action="create_user.php" method="POST">
Username: <input type="text" name="username" /><br />
Password: <input type="text" name="password" />
<input type="submit" />
</form>

</body>
</html>

and create_user.php is

Code:

<html>
<body>
<?php
echo $_POST[username];
$user = $_POST[username];
$password = $_POST[password];
exec ("sudo /sbin/useradd $user -p $password" );

?>

</body>
</html>

but no user added

please someone tell is i am doing right or i have to do something else for createing users.

anomie · 12-24-2011, 10:31 AM

Check PHP's logging, or turn on display_errors. It's a lot easier to debug problems when you let PHP tell you what is wrong (rather than guessing).

And, seriously: You are accepting user input, you are not validating it or scrubbing it, and then you are passing it to the shell.

Please read the OWASP Top 10 (in particular, the very first item on the list), and do not deploy your application until you've addressed it.