Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

When should we be wary of backticks in PHP?

Tags:

php

The fine manual states thus:

Unlike some other languages, backticks cannot be used within double-quoted strings.

However, empirical testing finds no problems:

$ cat test.php 
#!/usr/bin/php -q
<?php
echo "O`reilly\n";
echo `ls`;
echo "\n";
?>

$ ./test.php 
O`reilly
test.php

$ php --version
PHP 5.3.6-13ubuntu3.7 with Suhosin-Patch (cli) (built: May  4 2012 00:50:06) 
Copyright (c) 1997-2011 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2011 Zend Technologies
    with Xdebug v2.1.0, Copyright (c) 2002-2010, by Derick Rethans

Obviously safe mode is off due to the backticks working in the ls line, and I see that sage mode is disabled in php.ini. On other servers with safe mode I have used backticks in SQL queries and I do not recall ever having an issue. So why does the manual have the warning about backticks in double-quoted strings?

like image 619
dotancohen Avatar asked Jan 28 '26 02:01

dotancohen


1 Answers

The section you are reading from called "Execution Operators". Thus, the phrase "Unlike some other languages, backticks cannot be used within double-quoted strings" means this:

You cannot use backticks within double-quoted strings as execution operator.

i.e. echo "`ls`"; outputs `ls`, not the result of ls

like image 71
akond Avatar answered Jan 29 '26 14:01

akond