If you want to execute a command, and get both stderr and stdout, not "merged", a solution would probably to use proc_open, which provides a great level of control over the command that's being executed -- including a way to pipe stdin/stdout/stderr.

And here is an example : let's consider we have this shell-script, in test.sh, which writes to both stderr and stdout :

#!/bin/bash

echo 'this is on stdout';
echo 'this is on stdout too';

echo 'this is on stderr' >&2;
echo 'this is on stderr too' >&2;

Now, let's code some PHP, in temp.php -- first, we initialize the i/o descriptors :

$descriptorspec = [
   0 => ["pipe", "r"],  // stdin
   1 => ["pipe", "w"],  // stdout
   2 => ["pipe", "w"],  // stderr
];

And, then, execute the test.sh command, using those descriptors, in the current directory, and saying the i/o should be from/to $pipes :

$process = proc_open('./test.sh', $descriptorspec, $pipes, dirname(__FILE__), null);

We can now read from the two output pipes :

$stdout = stream_get_contents($pipes[1]);
fclose($pipes[1]);

$stderr = stream_get_contents($pipes[2]);
fclose($pipes[2]);

And, if we output the content of those two variables :

echo "stdout : \n";
var_dump($stdout);

echo "stderr :\n";
var_dump($stderr);

We get the following output when executing the temp.php script :

$ php ./temp.php
stdout :
string(40) "this is on stdout
this is on stdout too
"
stderr :
string(40) "this is on stderr
this is on stderr too
"

The error data is output from the target program's STDERR stream. You can get access to the error data through the normal returned string from shell_exec() by appending 2>&1 to the command, which will redirect STDERR to STDOUT, the stream that you are currently seeing:

var_dump(shell_exec("ffmpeg -i /var/www/html/sitedomain/httpdocs/tmp/ebev1177.mp4 2>&1"));

You may also want to take a look at proc_open() which will allow you to get access to STDIN, STDOUT and STDERR as three individual streams, which can afford much finer grained control over the target program and exactly how you handle the input and output to it, including redirecting any and all of them directly to a log file if so desired. Be aware though that this is a much more complex mechanism with many pitfalls and tripping hazards.

More information on the standard streams can be found here.

As you've already seen, when using shell_exec you have to chain your "real" command with echo $? to get the exit status:

 $output_including_status = shell_exec("command 2>&1; echo $?");

but if you want the clean way, then you want to use the exec function, which allows a 3rd agument explicitly for this purpose.

On the php manual for shell_exec, it shows that the function returns the output as a string. If you expect output from the program you launch, you need to capture this like so:

$execQuery = "echo -n test_command";
$output = shell_exec($execQuery);
echo $output;

Your question doesn't show trying to capture any data. If you also make sure to connect stdout and stderr when you run your command, you should get a better idea is what is going on. To use your example:

$output = shell_exec("/usr/bin/oneuser create test10 test10 2>&1");
var_dump($output);

That should help you see what is going on. As Shadur suggests, it seems likely that these programs expect an interactive terminal that can enter passwords in order to run. Even if don't need input, they might expect interactive shells. And he's right that su doesn't play nice in this context. There is, however, a correct tool for the job.

You can setup sudo to such that your http user can execute your program as username without a password but NOT be able to do anything else by running visudo or whatever you use to edit your sudoers file and adding this line:

http    ALL=(username) /usr/bin/oneadmin

Then in php your command would look something like this:

$execQuery = "sudo -u username /usr/bin/oneadmin postgres -c '/usr/bin/oneuser create test10 test10'";
$out = shell_exec ("$execQuery 2>&1");
echo $out

PHP's documentation page on shell_exec() has comments that address your issues. Basically the issue is that shell_exec only saves the output of stdout to the variable, and stderr is sent directly to the user.

However, I highly recommend that you look into configuration management systems like Puppet or Ansible to perform these tasks. There are far too many security issues in your approach and I think you don't have the knowledge on how to even identify possible issues.

shell_exec returns all of the output stream as a string. exec returns the last line of the output by default, but can provide all output as an array specifed as the second parameter.

See

• http://php.net/manual/en/function.shell-exec.php
• http://php.net/manual/en/function.exec.php

Update and answer for the benefit of anyone who comes here with a similar issue.

After spending a lot of time on this I gave up with exec() and gave proc_open() a try instead.

Doing it this way now works locally and on the server:

<?php
$cmd = "__test.bat";

$descriptorspec = array(
    0 => array("pipe", "r"), // STDIN
    1 => array("pipe", "w"), // STDOUT
    2 => array("pipe", "w"), // STDERR
);
$cwd = getcwd();
$env = null;

$proc = proc_open($cmd, $descriptorspec, $pipes, $cwd, $env);
if (is_resource($proc)) {
    // Output test:
    echo "STDOUT:<br />";
    echo "<pre>".stream_get_contents($pipes[1])."</pre>";
    echo "STDERR:<br />";
    echo "<pre>".stream_get_contents($pipes[2])."</pre>";
    $return_value = proc_close($proc);
    echo "Exited with status: {$return_value}";
}
?>

For some reason, missing out the getcwd() part causes the command to fail on the server unless I specify the complete path, whereas locally that is not an issue.

With this method I can append 2>&1 to redirect all output to STDIN. To output to a file, the manual shows that the $descriptorspec array can be modified e.g: 2 => array("file", "stderr.log", "a") (I have not yet tested this though)

One difference here is that if I want to retrieve the output in PHP, rather than getting all of the lines in an array, I need to read from the streams using stream_get_contents().

I still don't understand why there was an issue with using exec(), but this method seems to work both locally and on the server - If anyone knows why this could be, please let me know!