Typically, for passing arguments to a command line script, you will use either the argv global variable or getopt:

// Bash command:
//   php -e myscript.php hello
echo $argv[1]; // Prints "hello"

// Bash command:
//   php -e myscript.php -f=world
$opts = getopt('f:');
echo $opts['f']; // Prints "world"

$_GET refers to the HTTP GET method parameters, which are unavailable on the command line, since they require a web server to populate.

If you really want to populate $_GET anyway, you can do this:

// Bash command:
//   export QUERY_STRING="var=value&arg=value" ; php -e myscript.php
parse_str($_SERVER['QUERY_STRING'], $_GET);
print_r($_GET);
/* Outputs:
     Array(
        [var] => value
        [arg] => value
     )
*/

You can also execute a given script, populate $_GET from the command line, without having to modify said script:

export QUERY_STRING="var=value&arg=value" ; \
php -e -r 'parse_str($_SERVER["QUERY_STRING"], $_GET); include "index.php";'

Note that you can do the same with $_POST and $_COOKIE as well.

Definitively not secure as is,

Like any user's input, you'll have to not only escape quotes, but also verify the conformity of the data being submitted and have to be strict on that.

For e.g.: if the "sometool" command is waiting for a path, you've to ensure that the user input is a valid path. If the path has to be in a restricted location, you've to check that restriction.

Assuming that your "str" has to be a valid string, you can begin with the filter input function.

https://www.php.net/manual/en/function.filter-input.php

Make sure to use the appropriate filters (for quotes, encoding, etc.) : https://www.php.net/manual/en/filter.filters.php.

It will not be possible to by-pass the escaping here.

This somehow ensure the conformity of the data, but still, you've to be sure that the command "sometool" itself will not be affected by any valid string characters or syntax, that's what makes it still unsecure to use.

The previous answers seem all to be a little confusing or incomplete, so here is a table of the differences...

+----------------+-----------------+----------------+----------------+
|    Command     | Displays Output | Can Get Output | Gets Exit Code |
+----------------+-----------------+----------------+----------------+
| system()       | Yes (as text)   | Last line only | Yes            |
| passthru()     | Yes (raw)       | No             | Yes            |
| exec()         | No              | Yes (array)    | Yes            |
| shell_exec()   | No              | Yes (string)   | No             |
| backticks (``) | No              | Yes (string)   | No             |
+----------------+-----------------+----------------+----------------+

• "Displays Output" means it streams the output to the browser (or command line output if running from a command line).
• "Can Get Output" means you can get the output of the command and assign it to a PHP variable.
• The "exit code" is a special value returned by the command (also called the "return status"). Zero usually means it was successful, other values are usually error codes.

Other misc things to be aware of:

• The shell_exec() and the backticks operator do the same thing.
• There are also proc_open() and popen() which allow you to interactively read/write streams with an executing command.
• Add "2>&1" to the command string if you also want to capture/display error messages.
• Use escapeshellcmd() to escape command arguments that may contain problem characters.
• If passing an $output variable to exec() to store the output, if $output isn't empty, it will append the new output to it. So you may need to unset($output) first.