Variables in exec not working as they should?

[John_A]

I've got a mailing list (uses DadaMail) which provides a perl script (subscribe_email.pl) so that I can pass subscribers to it thorugh a PHP script.

 

Info here: http://dadamailproject.com/support/documentation-5_0_1/COOKBOOK-subscriptions.pod.html#command_line_utility___subscribe_email_pl

 

The trouble is I can get it working when variables are passed to it via URL query strings, but when I try to hard-code variables into it it stops working. I can't see any reason for this, it's got me really confused.

 

This works: -

 

<?php
// example usage: -
// http://www.domain.com/ds1.php?sendto=user@domain.com&title=Mr&forename=John&surname=Doe&company=None&country=UK

if (isset($_GET['sendto'])) {
$email = $_GET['sendto'];
}

if (isset($_GET['title'])) {
$title = preg_replace("/[^A-Za-z ]/", "", $_GET['title']);
}

if (isset($_GET['forename'])) {
$forename = preg_replace("/[^A-Za-z\-. ]/", "", $_GET['forename']);
}

if (isset($_GET['surname'])) {
$surname = preg_replace("/[^A-Za-z\-. ]/", "", $_GET['surname']);
}

if (isset($_GET['company'])) {
$company = preg_replace("/[^A-Za-z()\-.& ]/", "", $_GET['company']);
$company = str_replace('&', 'and', $company);
}

if (isset($_GET['country'])) {
$country = preg_replace("/[^A-Za-z\-.& ]/", "", $_GET['country']);
$country = str_replace('&', 'and', $country);
}

if (isset($email)) {
$exec_command = 'perl ./subscribe_email.pl --list mylist --email '. $email;
if (isset($title)) $exec_command .= ' --fields title '. $title;
if (isset($forename)) $exec_command .= ' --fields forename '. $forename;
if (isset($surname)) $exec_command .= ' --fields surname '. $surname;
if (isset($company)) $exec_command .= ' --fields company '. $company;
if (isset($country)) $exec_command .= ' --fields country '. $country;
exec(escapeshellcmd($exec_command));
} else {
echo 'Nothing to do';
}
?>

 

The mail address and all the parameters are passed to the subscribe_email.pl script.

 

But, this doesn't work: -

 

<?php
$subscriber_email = 'user@domain.com';
$subscriber_title = 'Mr';
$subscriber_forename = 'John';
$subscriber_surname = 'Doe';
$subscriber_company = 'None';
$subscriber_country = 'UK';

if (isset($subscriber_email)) {
$email = escapeshellcmd($subscriber_email);
}

if (isset($subscriber_title)) {
$title = preg_replace("/[^A-Za-z ]/", "", $subscriber_title);
}

if (isset($subscriber_forename)) {
$forename = preg_replace("/[^A-Za-z\-. ]/", "", $subscriber_forename);
}

if (isset($subscriber_surname)) {
$surname = preg_replace("/[^A-Za-z\-. ]/", "", $subscriber_surname);
}

if (isset($subscriber_company)) {
$company = preg_replace("/[^A-Za-z()\-. ]/", "", $subscriber_company);
$company = str_replace('&', 'and', $company);
}

if (isset($subscriber_country)) {
$country = preg_replace("/[^A-Za-z\-. ]/", "", $subscriber_country);
$country = str_replace('&', 'and', $country);
}

if (isset($email)) {
$exec_command = 'perl ./subscribe_email.pl --list mylist --email '. $email;
if (isset($title)) $exec_command .= ' --fields title '. $title;
if (isset($forename)) $exec_command .= ' --fields forename '. $forename;
if (isset($surname)) $exec_command .= ' --fields surname '. $surname;
if (isset($company)) $exec_command .= ' --fields company '. $company;
if (isset($country)) $exec_command .= ' --fields country '. $country;
exec(escapeshellcmd($exec_command));
} else {
echo 'Nothing to do';
}
?>

 

In the second example, only the list and email parameters are passed, all the others are lost (or ignored).

 

All that's different between the two is the way the variables are inititally set, I can't for the life of me figure out why the second one isn't working  .

 

Even stranger, I tried testing with just: -

 

<?php
exec("perl ./subscribe_email.pl --list mylist --email user@domain.com --fields title Mr --fields forename John--fields surname Doe --fields company None --fields country UK")
?>

 

and this doesn't work fully either (again just the list and email parameters are passed).

 

Unfortunately, it's the second method I need to use as it's tagged on to the end of a contact form processing script which initiates the subscription if a checkbox is left ticked...and all variables will be coming from this form script.

 

Any help greatly appreciated!

[Drummin]

Have you tried setting these variables with full quotes?

$subscriber_email = "user@domain.com";
$subscriber_title = "Mr";
$subscriber_forename = "John";
$subscriber_surname = "Doe";
$subscriber_company = "None";
$subscriber_country = "UK";

[John_A]

Have you tried setting these variables with full quotes?

 

I just did...it didn't make any difference.

[Drummin]

Well then seems it's your escapeshellcmd() that's killing it.  Having not used it I can't offer help with that but as you $email variable is the key it obviously is not being set under escapeshellcmd().

[John_A]

Well then seems it's your escapeshellcmd() that's killing it.  Having not used it I can't offer help with that but as you $email variable is the key it obviously is not being set under escapeshellcmd().

 

I removed the use of escapeshellcmd() in the email (I actually meant to do that before posting) and also from the exec() to make sure, and the result was the same - only the list and email parameters work