shell_exec returns all of the output stream as a string. exec returns the last line of the output by default, but can provide all output as an array specifed as the second parameter.

See

  • http://php.net/manual/en/function.shell-exec.php
  • http://php.net/manual/en/function.exec.php
Answer from Daniel A. White on Stack Overflow
Top answer
1 of 2
93

exec — Execute an external program

system — Execute an external program and display the output

shell_exec — Execute command via shell and return the complete output as a string

so if you don't need the output, I would go with exec.

Further details:

  • http://php.net/manual/en/function.exec.php
  • http://php.net/manual/en/function.system.php
  • http://php.net/shell_exec
2 of 2
0

Just expanding on the existing answer with examples:

All functions will attempt to execute the command almost as if from the terminal. The main difference is in the output and error handling:

exec()

Outputs to var only the last line; Outputs array with each line to 2nd arg; Outputs result_code to 3rd arg -- any non-zero result_code is an error. Here's a list of result_codes

$last_line = exec('pwd;ls -alh', $all_lines_array, $result_code);
echo "LAST_LINE: $last_line";
print_r($all_lines_array);
echo "RESULT_CODE: $result_code";

/*
LAST_LINE: -rw-r--r-- 1 ubuntu psacln 1.2K Feb  7 03:43 index.php 

Array
(
    [0] => /var/www/vhosts/example.com/httpdocs/dir/subdir
    [1] => total 20K
    [2] => drwxr-xr-x 3 root         root   4.0K Feb  7 03:17 .
    [3] => drwxr-xr-x 7 ubuntu psacln 4.0K Feb  6 21:46 ..
    [4] => -rw-r--r-- 1 ubuntu psacln  550 Feb  6 22:45 .htaccess
    [5] => drwxr-xr-x 2 ubuntu psacln 4.0K Feb  7 00:22 cache
    [6] => -rw-r--r-- 1 ubuntu psacln 1.2K Feb  7 03:43 index.php
)

RESULT_CODE: 0
*/

shell_exec()

Outputs single or multiline plain text to var. Takes only 1 arg -- the command

$plain_text = shell_exec('pwd;ls -alh');
echo $plain_text;

/*
/var/www/vhosts/example.com/httpdocs/dir/subdir
total 20K
drwxr-xr-x 3 root         root   4.0K Feb  7 03:17 .
drwxr-xr-x 7 ubuntu psacln 4.0K Feb  6 21:46 ..
-rw-r--r-- 1 ubuntu psacln  550 Feb  6 22:45 .htaccess
drwxr-xr-x 2 ubuntu psacln 4.0K Feb  7 00:22 cache
-rw-r--r-- 1 ubuntu psacln 1.2K Feb  7 03:43 index.php
*/

system()

Echos single or multiline plain text. No need for echo system();. result_code is the same as exec()

system('pwd;ls -alh',$result_code);
echo "RESULT_CODE: $result_code";
/*
/var/www/vhosts/example.com/httpdocs/dir/subdir
total 20K
drwxr-xr-x 3 root         root   4.0K Feb  7 03:17 .
drwxr-xr-x 7 ubuntu psacln 4.0K Feb  6 21:46 ..
-rw-r--r-- 1 ubuntu psacln  550 Feb  6 22:45 .htaccess
drwxr-xr-x 2 ubuntu psacln 4.0K Feb  7 00:22 cache
-rw-r--r-- 1 ubuntu psacln 1.2K Feb  7 03:43 index.php

RESULT_CODE: 0
*/

Backtick quotes ``

Basically, alias for shell_exec(). Outputs single or multiline plain text to var

$plain_text = `pwd;ls -al`;
echo $plain_text;

/*
/var/www/vhosts/example.com/httpdocs/dir/subdir
total 20K
drwxr-xr-x 3 root         root   4.0K Feb  7 03:17 .
drwxr-xr-x 7 ubuntu psacln 4.0K Feb  6 21:46 ..
-rw-r--r-- 1 ubuntu psacln  550 Feb  6 22:45 .htaccess
drwxr-xr-x 2 ubuntu psacln 4.0K Feb  7 00:22 cache
-rw-r--r-- 1 ubuntu psacln 1.2K Feb  7 03:43 index.php
*/

exec() appears to be most versatile as you can iterate over the array of lines, get the last line only, and the result_code.

shell_exec() and backticks `` are great if plain text works better for you.

system() echos automatically :(

Discussions

What is different between exec(), shell_exec, system() and passthru() functions in PHP? - Stack Overflow
Communities for your favorite technologies. Explore all Collectives · Stack Overflow for Teams is now called Stack Internal. Bring the best of human thought and AI automation together at your work More on stackoverflow.com
🌐 stackoverflow.com
php - Difference between system and shell_exec - Stack Overflow
What is the difference between shell_exec and system methods in PHP? Both take a single command line argument and runs that within PHP. Is it better to use one over the other? More on stackoverflow.com
🌐 stackoverflow.com
Php Exec() Vs Shell_exec() Vs Over System() - Webune
If You Are Familiar With Php, Have You Ever Wondered What Is The Difference Between Exec(), Shell_exec() And System() More on webune.com
🌐 webune.com
command - PHP exec() vs system() vs passthru() - Stack Overflow
What are the differences? Is there a specific situation or reason for each function? If yes, can you give some examples of those situations? PHP.net says that they are used to execute external pr... More on stackoverflow.com
🌐 stackoverflow.com
🌐
W3Docs
w3docs.com › php
PHP exec() vs system() vs passthru()
<?php $output = exec('ls -l'); echo $output; system('ls -l'); passthru('ls -l');
🌐
PHP
php.net › manual › en › function.shell-exec.php
PHP: shell_exec - Manual
In my own opinion it is a horrible idea to pass a system command through a SUID-- ie have the SUID accept the name of a command as a parameter. You may as well run Apache as root! ... I'm not sure what shell you are going to get with this function, but you can find out like this: <?php $cmd = 'set'; echo "<pre>".shell_exec($cmd)."</pre>"; ?> On my FreeBSD 6.1 box I get this: USER=root LD_LIBRARY_PATH=/usr/local/lib/apache2: HOME=/root PS1='$ ' OPTIND=1 PS2='> ' LOGNAME=root PPID=88057 PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin SHELL=/bin/sh IFS=' ' Very interesting.
🌐
Kavoir
kavoir.com › 2009 › 06 › php-differences-between-exec-system-and-passthru.html
PHP: Differences between exec(), shell_exec(), system() and passthru() – Kavoir LLC
June 2, 2009 - All 3 PHP functions: exec(), system() and passthru() executes an external command, but the differences are: exec(): returns the last line of output from the command and flushes nothing. shell_exec(): returns the entire output from the command and flushes nothing.
Find elsewhere
🌐
GeeksforGeeks
geeksforgeeks.org › php › explain-the-difference-between-shell_exec-and-exec-functions
Explain the Difference Between shell_exec() and exec() Functions - GeeksforGeeks
July 23, 2025 - shell_exec() Function: The shell_exec() function is an inbuilt function in PHP that is used to execute the commands via shell and return the complete output as a string. The shell_exec is an alias for the backtick operator, for those used to *nix.
🌐
Webune
webune.com › forums › php-exec-vs-shell-exec-vs-over-system.html
Php Exec() Vs Shell_exec() Vs Over System() - Webune
] system — Execute an external program and display the output system() is just like the C version of the function in that it executes the given command and outputs the result. The system() call also tries to automatically flush the web server's output buffer after each line of output ...
🌐
Jeff Schaefer
schaefersoftware.com › exec-passthru-shell_exec-system
What's the difference between exec(), passthru(), shell_exec(), and system()? - Jeff Schaefer
April 25, 2016 - For running basic commands, this is your function. It can also be run shorthand using the backtick operator. system() will echo the result of the command rather than passing it in the return value.
🌐
Hacking with PHP
hackingwithphp.com › 4 › 12 › 0 › executing-external-programs
Executing external programs: exec(), passthru(), and virtual() – Hacking with PHP - Practical PHP
Note that fortune may not be installed or available to your PHP scripts - contact your system administrator to find out. There are other execution functions available, notably shell_exec() and system(), however they are largely irrelevant - shell_exec(), for example, works in exactly the same ...
Top answer
1 of 5
220

They have slightly different purposes.

  • exec() is for calling a system command, and perhaps dealing with the output yourself.
  • system() is for executing a system command and immediately displaying the output - presumably text.
  • passthru() is for executing a system command which you wish the raw return from - presumably something binary.

Regardless, I suggest you not use any of them. They all produce highly unportable code.

2 of 5
174

The previous answers seem all to be a little confusing or incomplete, so here is a table of the differences...

+----------------+-----------------+----------------+----------------+
|    Command     | Displays Output | Can Get Output | Gets Exit Code |
+----------------+-----------------+----------------+----------------+
| system()       | Yes (as text)   | Last line only | Yes            |
| passthru()     | Yes (raw)       | No             | Yes            |
| exec()         | No              | Yes (array)    | Yes            |
| shell_exec()   | No              | Yes (string)   | No             |
| backticks (``) | No              | Yes (string)   | No             |
+----------------+-----------------+----------------+----------------+
  • "Displays Output" means it streams the output to the browser (or command line output if running from a command line).
  • "Can Get Output" means you can get the output of the command and assign it to a PHP variable.
  • The "exit code" is a special value returned by the command (also called the "return status"). Zero usually means it was successful, other values are usually error codes.

Other misc things to be aware of:

  • The shell_exec() and the backticks operator do the same thing.
  • There are also proc_open() and popen() which allow you to interactively read/write streams with an executing command.
  • Add "2>&1" to the command string if you also want to capture/display error messages.
  • Use escapeshellcmd() to escape command arguments that may contain problem characters.
  • If passing an $output variable to exec() to store the output, if $output isn't empty, it will append the new output to it. So you may need to unset($output) first.
🌐
GeeksforGeeks
geeksforgeeks.org › php › php-shell_exec-vs-exec-function
PHP shell_exec() vs exec() Function - GeeksforGeeks
July 11, 2025 - The exec() function in PHP executes an external command via the shell but only returns the last line of the output as a string.
🌐
Wikitechy
wikitechy.com › technology › php-shell_exec-vs-exec
php shell_exec() vs exec() - Wikitechy
October 30, 2018 - shell_exec · Description · Example ... executable in the path) echo exec('whoami'); ?> [ad type=”banner”] shell_exec — Execute command via shell and return the complete output as a string ·...
🌐
KnownHost
knownhost.com › forums › knownhost shared and reseller hosting › cpanel shared hosting
php exec() or system() or even shell_exec()... | KnownHost Community Forum
May 13, 2010 - Quick reply to self since I can't edit my last message: My php works just lovely in cron without me doing any sort of changes. I'm adverse to not being able to test on a system before tossing in cron, but I'll deal. My form logic was that I'd call the same php file, and if an action was desired, exec/system/shell_exec the php script to handle it.
🌐
Acunetix
acunetix.com › blog › articles › web-shells-101-using-php-introduction-web-shells-part-2
Web Shells 101 Using PHP (Web Shells Part 2) | Acunetix
March 5, 2025 - Surprisingly, not many PHP developers are aware of this but PHP will execute the contents of backticks (`) as a shell command. Note: The backtick character (`) should not to be confused with the single quote character (‘) <?php $output = `whoami`; echo "<pre>$output</pre>"; ?> --> www-data · Based on the above, the following is a PHP web shell in its simplest form. ... It uses the system() function to execute commands that are being passed through ‘cmd’ HTTP request GET parameter.