They have slightly different purposes.
exec()is for calling a system command, and perhaps dealing with the output yourself.system()is for executing a system command and immediately displaying the output - presumably text.passthru()is for executing a system command which you wish the raw return from - presumably something binary.
Regardless, I suggest you not use any of them. They all produce highly unportable code.
Answer from Kalium on Stack OverflowPHP
php.net โบ manual โบ en โบ function.system.php
PHP: system - Manual
You probably want to check your system calls for errors. The convention is to return 0 for "no error" which is the same as FALSE which can be confusing. You need to do something like: <?php $cmd = "/usr/bin/pngtopnm $png_file > $pnm_file"; system($cmd,$return_value); ($return_value == 0) or die("returned an error: $cmd"); ?>
Top answer 1 of 5
220
They have slightly different purposes.
exec()is for calling a system command, and perhaps dealing with the output yourself.system()is for executing a system command and immediately displaying the output - presumably text.passthru()is for executing a system command which you wish the raw return from - presumably something binary.
Regardless, I suggest you not use any of them. They all produce highly unportable code.
2 of 5
173
The previous answers seem all to be a little confusing or incomplete, so here is a table of the differences...
+----------------+-----------------+----------------+----------------+
| Command | Displays Output | Can Get Output | Gets Exit Code |
+----------------+-----------------+----------------+----------------+
| system() | Yes (as text) | Last line only | Yes |
| passthru() | Yes (raw) | No | Yes |
| exec() | No | Yes (array) | Yes |
| shell_exec() | No | Yes (string) | No |
| backticks (``) | No | Yes (string) | No |
+----------------+-----------------+----------------+----------------+
- "Displays Output" means it streams the output to the browser (or command line output if running from a command line).
- "Can Get Output" means you can get the output of the command and assign it to a PHP variable.
- The "exit code" is a special value returned by the command (also called the "return status"). Zero usually means it was successful, other values are usually error codes.
Other misc things to be aware of:
- The shell_exec() and the backticks operator do the same thing.
- There are also proc_open() and popen() which allow you to interactively read/write streams with an executing command.
- Add "2>&1" to the command string if you also want to capture/display error messages.
- Use escapeshellcmd() to escape command arguments that may contain problem characters.
- If passing an $output variable to exec() to store the output, if $output isn't empty, it will append the new output to it. So you may need to unset($output) first.
Execute php file from C program with system()
What happens if you run that command directly from the command-line instead of from the C script? More on reddit.com
Running system command from php
I am trying to put together a page that displays different information about the system. One of the commands I want to run is hdparm so that I can gather the hard drive serial number. My code looks like this: $hd = system("hdparm -I /dev/sda"); echo $hd; But I get nothing when I pull up the... More on tek-tips.com
How do malicious hackers use web shells?
Malicious hackers use web shells to take control of an already compromised server. First, they exploit a vulnerability in your website or web application such as SQL injection, remote code execution, or others. Then, they upload a web shell to your web server. From now on, they can run any commands that they like on your server.
See a step-by-step example of an attack that leads to full server compromise.
acunetix.com
acunetix.com โบ blog โบ articles โบ web-shells-101-using-php-introduction-web-shells-part-2
Web Shells 101 Using PHP (Web Shells Part 2) | Acunetix
What is a web shell?
A web shell is a small application that an attacker runs on your web server. They can then use this application to remotely access your server and run commands on it. A web shell by itself is never an attack, it is the aftermath of a successful attack on your website or web application. This means that if you have a web shell, you have a much more serious problem to worry about.
See how a web shell works in practice.
acunetix.com
acunetix.com โบ blog โบ articles โบ web-shells-101-using-php-introduction-web-shells-part-2
Web Shells 101 Using PHP (Web Shells Part 2) | Acunetix
How can I detect web shells?
You can detect web shells by log analysis. However, you should not focus on detecting web shells but instead, you should detect vulnerabilities that can let attackers take control of your server. Even if you detect a web shell, that will not stop attackers from taking over control again if the vulnerabilities are still there. To detect web vulnerabilities and learn how to eliminate them, use Acunetix.
See what Acunetix Premium can do for you.
acunetix.com
acunetix.com โบ blog โบ articles โบ web-shells-101-using-php-introduction-web-shells-part-2
Web Shells 101 Using PHP (Web Shells Part 2) | Acunetix
Videos
08:50
PHP how to connect to MySQL database - YouTube
How to Build a PHP System That Handles 100 Million ...
03:09
Running System Commands in PHP - PHP Tutorial Beginner to Advanced ...
09:52
Working With File System In PHP - Full PHP 8 Tutorial - YouTube
01:07:58
PHP's Type System Dissected | PHP Sussex - YouTube
07:04
PHP Tutorial - 12 - Executing External Programs in PHP - System ...
Tutorialspoint
tutorialspoint.com โบ php โบ php_system_calls.htm
PHP System Calls
The system() call tries to automatically flush the web server's output buffer after each line of output if PHP is running as a server module.
BCCNsoft
doc.bccnsoft.com โบ docs โบ php-docs-7-en โบ function.system.html
Execute an external program and display the output
<?php echo '<pre>'; // Outputs all the result of shellcommand "ls", and returns // the last output line into $last_line. Stores the return value // of the shell command in $retval. $last_line = system('ls', $retval); // Printing additional info echo ' </pre> <hr />Last line of the output: ' .
GitHub
github.com โบ php โบ systems
GitHub - php/systems: Hooks and Cronjobs for PHP Infrastructure ยท GitHub
This repository holds configuration files and documentation about the systems used for the PHP.net infrastructure.
Starred by 56 users
Forked by 32 users
Languages ย Shell 73.1% | PHP 25.5% | Perl 1.4%
Exakat
php-dictionary.readthedocs.io โบ en โบ latest โบ dictionary โบ system-call.ini.html
System Call โ PHP Dictionary 1.0.152 documentation
January 22, 2026 - A system call is a call to an operating system function. In PHP, those are done with the shell_exec(), system() and exec() functions; and the `` (back tick) operators.
W3Schools
w3schools.com โบ php โบ php_ref_filesystem.asp
PHP Filesystem Functions
PHP Strings String Functions Modify Strings Concatenate Strings Slicing Strings Escape Characters PHP Numbers PHP Casting PHP Math PHP Constants PHP Magic Constants PHP Operators PHP If...Else...Elseif
Wikipedia
en.wikipedia.org โบ wiki โบ PHP
PHP - Wikipedia
2 days ago - It also introduced a standard way of declaring constructors and destructors, similar to that of other object-oriented languages such as C++, and a standard exception handling model. Furthermore, PHP 5 added interfaces and allowed for multiple interfaces to be implemented. There are special interfaces that allow objects to interact with the runtime system.
Reddit
reddit.com โบ r/c_programming โบ execute php file from c program with system()
r/C_Programming on Reddit: Execute php file from C program with system()
December 15, 2023 -
I am trying to accomplish executing a php file from my C program. I do not need to pass any information to or from the PHP script, I just want it to run.
In my C program I have:
system("/usr/bin/php /var/www/bbq/alerthandler.php")And alerthandler.php contains:
#!/usr/bin/php
<?php
$myfile = fopen("newfile.txt", "w") or die("Unable to open file!");
$txt = "John Doe\n";
fwrite($myfile, $txt);
$txt = "Jane Doe\n";
fwrite($myfile, $txt);
fclose($myfile);
?>I've also done sudo chown -R pi:www-data /var/www/bbq and sudo chmod -R 777 /var/www/bbq and it's not writing to file. Am I doing something wrong?
Top answer 1 of 3
3
What happens if you run that command directly from the command-line instead of from the C script?
2 of 3
3
You don't even need the "/usr/bin/php" in the system since the php file has the #! line in it. The obvious questions... Is the PHP file running at all or is it failing internally? Are you typing the exact same command in the same directory that is current in your C program?
PHP
wiki.php.net โบ systems
PHP: systems
May 1, 2024 - Email the .google_authenticator file and your SSH key file to systems@php.net.
TechRepublic
techrepublic.com โบ home โบ topics โบ operating systems โบ windows forum โบ php system commands
PHP System commands - TechRepublic
July 16, 2009 - system(โtracert -d 4.2.2.2 | grep โmsโ | gawk โ{print ($2+$4+$6)/3 \โ,\โ \โhttp://who-is.net/php-nslookup.php?host=\โ$8\โ^&submit=ReverseIP\โ \โ,\โ \โWindow2\โ}โ >> trace.txtโ);
Tek-Tips
tek-tips.com โบ home โบ forums โบ software โบ programmers โบ web development โบ php
Running system command from php | Tek-Tips
May 21, 2010 - I am trying to put together a page that displays different information about the system. One of the commands I want to run is hdparm so that I can gather the hard drive serial number. My code looks like this: $hd = system("hdparm -I /dev/sda"); echo $hd; But I get nothing when I pull up the...