As you've already seen, when using shell_exec you have to chain your "real" command with echo $? to get the exit status:

 $output_including_status = shell_exec("command 2>&1; echo $?");

but if you want the clean way, then you want to use the exec function, which allows a 3rd agument explicitly for this purpose.

On the php manual for shell_exec, it shows that the function returns the output as a string. If you expect output from the program you launch, you need to capture this like so:

$execQuery = "echo -n test_command";
$output = shell_exec($execQuery);
echo $output;

Your question doesn't show trying to capture any data. If you also make sure to connect stdout and stderr when you run your command, you should get a better idea is what is going on. To use your example:

$output = shell_exec("/usr/bin/oneuser create test10 test10 2>&1");
var_dump($output);

That should help you see what is going on. As Shadur suggests, it seems likely that these programs expect an interactive terminal that can enter passwords in order to run. Even if don't need input, they might expect interactive shells. And he's right that su doesn't play nice in this context. There is, however, a correct tool for the job.

You can setup sudo to such that your http user can execute your program as username without a password but NOT be able to do anything else by running visudo or whatever you use to edit your sudoers file and adding this line:

http    ALL=(username) /usr/bin/oneadmin

Then in php your command would look something like this:

$execQuery = "sudo -u username /usr/bin/oneadmin postgres -c '/usr/bin/oneuser create test10 test10'";
$out = shell_exec ("$execQuery 2>&1");
echo $out

To read the output of a process, popen() is the way to go. Your script will run in parallel with the program and you can interact with it by reading and writing it's output/input as if it was a file.

But if you just want to dump it's result straight to the user you can cut to the chase and use passthru():

echo '<pre>';
passthru($cmd);
echo '</pre>';

If you want to display the output at run time as the program goes, you can do this:

while (@ ob_end_flush()); // end all output buffers if any

$proc = popen($cmd, 'r');
echo '<pre>';
while (!feof($proc))
{
    echo fread($proc, 4096);
    @ flush();
}
echo '</pre>';

This code should run the command and push the output straight to the end user at run time.

More useful information

Note that if you are using sessions then having one of those running will prevent the user from loading other pages, as sessions enforce that concurrent requests cannot happen. To prevent this from being a problem, call session_write_close() before the loop.

If your server is behind a nginx gateway, then the nginx buffering may be disruptive to the desired behavior. Set the header header('X-Accel-Buffering: no'); to hint nginx that it shouldn't do that. As headers are sent first, this has to be called in the beginning of the script, before any data is sent.

PHP's documentation page on shell_exec() has comments that address your issues. Basically the issue is that shell_exec only saves the output of stdout to the variable, and stderr is sent directly to the user.

However, I highly recommend that you look into configuration management systems like Puppet or Ansible to perform these tasks. There are far too many security issues in your approach and I think you don't have the knowledge on how to even identify possible issues.

shell_exec returns all of the output stream as a string. exec returns the last line of the output by default, but can provide all output as an array specifed as the second parameter.

See

• http://php.net/manual/en/function.shell-exec.php
• http://php.net/manual/en/function.exec.php

The error data is output from the target program's STDERR stream. You can get access to the error data through the normal returned string from shell_exec() by appending 2>&1 to the command, which will redirect STDERR to STDOUT, the stream that you are currently seeing:

var_dump(shell_exec("ffmpeg -i /var/www/html/sitedomain/httpdocs/tmp/ebev1177.mp4 2>&1"));

You may also want to take a look at proc_open() which will allow you to get access to STDIN, STDOUT and STDERR as three individual streams, which can afford much finer grained control over the target program and exactly how you handle the input and output to it, including redirecting any and all of them directly to a log file if so desired. Be aware though that this is a much more complex mechanism with many pitfalls and tripping hazards.

More information on the standard streams can be found here.