[SOLVED] Web page input executes on command line and output back to web page

keif · 02-26-2014, 07:57 AM

Hello everyone,

I have a simple grep task I want to make executable in my web browser. Here is the script:

from: ./grep-script.sh

Code:

#!/bin/bash 
#
# Get input from user to grep in /home/user/test-file.txt
#
echo -n "Please enter grep input: "
read grepInput
grep $grepInput /home/user/test-file.txt

Instead of having going to the command line to run ./grep-script.sh, I want to have an input box and a button on the web page. The info in the input box becomes the read variable when you click the button. Then it executes the script on the command line and brings back the results on the web page.

The web page is from the same box I wish to execute the grep command -- /var/www/html/index.html. And I have apache installed.

I know the task itself is basically worthless. But the main point is to learn a simple task like this in order to open doors to larger projects.

Any ideas on how to do this? Thanks.

szboardstretcher · 02-26-2014, 08:15 AM

You will need the exec command to execute grep: http://us2.php.net/function.exec

You will need some practical HTML: http://www.w3schools.com/tags/

You will not need a script for this. You can build the whole command in the exec statement.

Not tested, but this should get you close:

Your HTML page.. index.html

Code:

<form action="backend.php" method="post">
		<button type="submit" name="formname" value="search"></button>
		<input type="text" name="search">
</form>

Your backend page,.. backend.php

Code:

        $escaped_search = escapeshellcmd($_POST["search"]);
	exec("grep -Ri $escaped_search *",$output);                 
        echo "<pre>";
        foreach ($output as $line) {
          echo "$line <br>";
        } //end foreach

dugan · 02-26-2014, 09:15 AM

szboardstretcher's solution is good, because it actually has the necessary security.

For a bad and extremely hackable solution (you know, to compare), see here:

http://www.reddit.com/r/PHP/comments...e_web_problem/

szboardstretcher · 02-26-2014, 09:25 AM

Quote:

Originally Posted by dugan

szboardstretcher's solution is good, because it actually has the necessary security.

For a bad and extremely hackable solution (you know, to compare), see here:

http://www.reddit.com/r/PHP/comments...e_web_problem/

Its unfortunate that that thread is not, in fact, a joke.

I'm not allowed to post company code,. but I can tell you this. Our user input forms are actually run from different servers, and the input is scrubbed *at least* 10 different ways, and even then it's checked by hardware before it gets truly submitted to the dmz'd input servers.

keif · 02-26-2014, 09:34 AM

Quote:

Originally Posted by szboardstretcher

Its unfortunate that that thread is not, in fact, a joke.

I'm not allowed to post company code,. but I can tell you this. Our user input forms are actually run from different servers, and the input is scrubbed *at least* 10 different ways, and even then it's checked by hardware before it gets truly submitted to the dmz'd input servers.

Thanks for the info szboardstretcher.

Your solution worked great. Thanks. It was perfect for the novice level I am at with this type of integration and I hope to grow from it. And explaining a little about your system helps me better see the reality of security concerns. I appreciate it.

szboardstretcher · 02-26-2014, 09:37 AM

Thanks for the expressive gratitude. That's nice to hear.

If you are interested in beginner level php, here is a great start:

http://www.codecademy.com/tracks/php

TenTenths · 02-26-2014, 10:06 AM

Quote:

Originally Posted by szboardstretcher

and even then it's checked by hardware before it gets truly submitted to the dmz'd input servers.

WAF's rock!

So do layered applications

keif · 02-26-2014, 10:25 AM

Quote:

Originally Posted by szboardstretcher

Thanks for the expressive gratitude. That's nice to hear.

If you are interested in beginner level php, here is a great start:

http://www.codecademy.com/tracks/php

Thanks! I didn't know about code academy, I really like their interface (I'm used to text and link bare bones tutorials).