<?php

$ret = exec('START C:\Program Files (x86)\Notepad++\Notepad++.exe', $output, $error);

// Debug
var_dump($ret);
var_dump($output);
var_dump($error);
?>

Update

maybe your php hasn't permissions to run commands on your wamp: https://stackoverflow.com/a/9161752/1721486

Answer from spinsch on Stack Overflow
🌐
PHP
php.net › manual › en › function.exec.php
PHP: exec - Manual
I tried to execute a command in background under Windows. After struggling for hours with all these half ready examples I would like to share the syntax I found working (for windows at least). This is not tested under Linux as there are more elegant ways to spawn a process. Based on the function from Arno van den Brink. <?php function execInBackground($cmd) { if (substr(php_uname(), 0, 7) == "Windows"){ pclose(popen("start /B ".
Discussions

PHP exec function passing a value to command line
Tibor Ruzinyi is having issues with: Hi there, i need some help from an advanced users in php. I need to call an exe file and send a value to the command line with t... More on teamtreehouse.com
🌐 teamtreehouse.com
4
October 1, 2014
Any way to SAFELY execute shell scripts from PHP?
Executing other applications (whether it's a shell script or something else) from a PHP application is not unsafe per se. The security depends heavily on how safe the application is and how much a user can control of the input. You must ensure a user never can control what exact command line is executed (and ensure that every parameter is properly escaped). If not absolutely necessary the user should also not control parameters of the application (and if only a specified subset of them). As long as you just call a static script without any dynamic input which is somehow user controllable, you should be relatively safe if the application and the action performed is safe. Maybe you should think about restricting or sandboxing the called applications (using techniques like selinux, user permissions, or containers), so it can only do its desired job and can do as little harm as possible. More on reddit.com
🌐 r/PHPhelp
10
9
February 26, 2024
php exec() or system() or even shell_exec()... | KnownHost Community Forum
I've spent enough time on this now that it's become personal. I can't seem to figure out how to run a _PHP_ script from PHP. I'm on shared hosting. I can run arbitrary commands from a php file. ps? sure. whoami? ls? which? Yes to all, and those are almost invasive. But... I can't... More on knownhost.com
🌐 knownhost.com
May 11, 2010
PHP exec() not working | php.ini is fine
Hi, I’ve seen few topics but nothing worked. My php.ini doesn’t block exec() or shell_exec(), but yet the shell command from php doesn’t execute. It works only from the terminal. I gave folder permissions to user: cyberpanel: still not working Please help Thanks More on community.cyberpanel.net
🌐 community.cyberpanel.net
1
0
March 7, 2023
🌐
O'Reilly
oreilly.com › library › view › php-in-a › 0596100671 › re48.html
exec() - PHP in a Nutshell [Book]
October 13, 2005 - If you pass a second and third parameter to exec(), the output of the command will be put into parameter two as an array with one line per element, and the numeric exit status of the command will be put into parameter three. Similarly, if you pass a second parameter to passthru(), it will be filled with the return value of the command. ... That example should work fine on Windows, as well as on many versions of Unix. PHP's exec() is more like the Perl execution operator ('...') than the Perl exec() function.
Author   Paul Hudson
Published   2005
Pages   372
🌐
ESLint
eslint.org › docs › latest › use › getting-started
Getting Started with ESLint
A pluggable and configurable linter tool for identifying and reporting on patterns in JavaScript. Maintain your code quality with ease.
🌐
Team Treehouse
teamtreehouse.com › community › php-exec-function-passing-a-value-to-command-line
PHP exec function passing a value to command line (Example) | Treehouse Community
October 1, 2014 - This means you can pass arguments to by putting a space between the file name and all the arguements (exactly like you would do in the command line). So, exec("example.php $var1 $var2") is the same as php -f example.php $var1 $var2 on the command line. Now the $argv variable come into pay in the executed script.
🌐
GeeksforGeeks
geeksforgeeks.org › php › php-shell_exec-vs-exec-function
PHP shell_exec() vs exec() Function - GeeksforGeeks
July 11, 2025 - The shell_exec() function in PHP executes a command via the shell and returns the complete output as a string.
Find elsewhere
🌐
Laravel
laravel.com › docs › 13.x › telescope
Laravel Telescope | Laravel 13.x - The clean stack for Artisans and agents
The command watcher records the arguments, options, exit code, and output whenever an Artisan command is executed. If you would like to exclude certain commands from being recorded by the watcher, you may specify the command in the ignore option within your config/telescope.php file:
🌐
Node.js
nodejs.org › en
Node.js
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
🌐
Reddit
reddit.com › r/phphelp › any way to safely execute shell scripts from php?
r/PHPhelp on Reddit: Any way to SAFELY execute shell scripts from PHP?
February 26, 2024 -

I have a website accessible from https://exampleurl.com:1234 (i.e. nonstandard port).

After logging in, this website gives my users a GUI and a few buttons. The buttons interact with PHP scripts on an Unraid VM, which then launch shell scripts. The shell scripts are used for controlling streams via streaming software called "OBS-Studio".

Here's an example:

my.php
<?php
$output = shell_exec("/bin/bash /var/www/html/streamstart.sh");
echo $output; 
?>


streamstart.sh
#!/bin/bash
obs-cmd streaming start

I'm relatively new to PHP, and I'm not sure how this could be exploited. Is there a way to make this more secure?

I have set the password for my users to be extremely secure, but that feels like the only line of defense right now.

Top answer
1 of 5
6
Executing other applications (whether it's a shell script or something else) from a PHP application is not unsafe per se. The security depends heavily on how safe the application is and how much a user can control of the input. You must ensure a user never can control what exact command line is executed (and ensure that every parameter is properly escaped). If not absolutely necessary the user should also not control parameters of the application (and if only a specified subset of them). As long as you just call a static script without any dynamic input which is somehow user controllable, you should be relatively safe if the application and the action performed is safe. Maybe you should think about restricting or sandboxing the called applications (using techniques like selinux, user permissions, or containers), so it can only do its desired job and can do as little harm as possible.
2 of 5
1
Executing a process from PHP is not inherently unsafe. There are some common scenarios that can create safety issues, though. First you have to realize that PHP is basically like a virtual user on the server. When you tell it to run a process, it runs that process with the user account that PHP is running as. So if PHP is running as a user account named "phpuser", and you tell PHP to run /usr/bin/foobar, then it'll be the same as if you logged into the server with the "phpuser" login and then ran foobar. That's not unsafe for you to log in and run that command, but let's pretend for a moment that you can't run foobar - it gives you some security error message. You look closer and see that foobar can only be executed by the "root" superuser account. The appropriate fix might be to see if the permissions on foobar are incorrect and need correction. Or it might actually be that you need to be root. The wrong thing here is to "fix" it by running PHP as root but some people do that. If PHP is ever compromised, then the attacker gets root-level access to the entire system. So the first thing to know is that you should never increase the permissions of the PHP to get around a security restriction. In almost every case, there is a better way, even if it's permitting sudo for just that one command. The second thing is to be aware that whatever information you pass on the command line will be visible to anyone else on the system who is looking at the list of running processes. So if I ran shell_exec("/usr/bin/customservice --password=FOOBAR"); ...then while customservice was running, anyone who listed the processes with ps or top would be able to see that password. So don't put any sensitive information into a parameter. The third thing is to know that environment variables will propagate from PHP to the child process you run. Some people follow the bad (but currently popular) practice of using environment variables for credentials. So make sure you clear any sensitive env variables before launching the process, so that the process doesn't accidentally leak them. Lastly, and most importantly, don't ever take user input and use it within the command line (unless you've heavily sanitized it).
🌐
ReqBin
reqbin.com › curl
Run Curl Commands Online
No desktop apps or browser plugins are required. Just enter the Curl command and click on Run. The built-in Curl command syntax Highlighter will check the syntax of the Curl commands and highlight possible errors while you are typing it in the ReqBin Curl command executor.
🌐
KnownHost
knownhost.com › forums › knownhost shared and reseller hosting › cpanel shared hosting
php exec() or system() or even shell_exec()... | KnownHost Community Forum
May 11, 2010 - Quick reply to self since I can't edit my last message: My php works just lovely in cron without me doing any sort of changes. I'm adverse to not being able to test on a system before tossing in cron, but I'll deal. My form logic was that I'd call the same php file, and if an action was desired, exec/system/shell_exec the php script to handle it.
🌐
CyberPanel Community
community.cyberpanel.net › support and discussion › general discussion
PHP exec() not working | php.ini is fine - General Discussion - CyberPanel Community
March 7, 2023 - Hi, I’ve seen few topics but nothing worked. My php.ini doesn’t block exec() or shell_exec(), but yet the shell command from php doesn’t execute. It works only from the terminal. I gave folder permissions to user: cy…
🌐
ArchWiki
wiki.archlinux.org › title › Iwd
iwd - ArchWiki
March 27, 2026 - [Service] ExecStartPre=ip link set wlan0 up · Since version 1.0, iwd disables network interface renaming to predictable network interface names. It installs the following systemd.link(5) configuration file which prevents udev from renaming the interface to a predictable, stable name (e.g.
🌐
Windsurf
windsurf.com › editor
Windsurf Editor
The first agentic IDE, and then some. The Windsurf Editor is where the work of developers and AI truly flow together, allowing for a coding experience that feels like literal magic · Introducing the flow evolution of Chat
🌐
CreativeDev
thecreativedev.com › home › web development › how to execute php code from the command line?
How to execute PHP code from the command line? | CreativeDev
May 8, 2017 - You can also execute the external command without outputting the result or response.If the output variable is set to the function, all the execution results are included into that variable in an array form. If you need to use it to run it in the background of the program, make sure that the output has been redirected to another file, otherwise, the php will wait for it to complete the implementation and then it will continue to the browser output.
🌐
Curl Converter
curlconverter.com
Curlconverter
PHP + cURL · PHP + Guzzle · PowerShell + Invoke-RestMethod · PowerShell + Invoke-WebRequest · Python + Requests · Python + http.client · R + httr · R + httr2 · Ruby + Net::HTTP · Ruby + HTTParty · Rust · Swift · Wget · Ansible · C · C# ColdFusion ·