open_basedir does not apply to shell_exec backticks?

[kenw232]

I have a script that simply does this:

 

<?

$sCMD = `/bin/cat /tmp/test.txt`;

echo $sCMD;

?>

 

This works. But my open_dirbase does not include /bin or /tmp. Does anyone know why executing a program using backticks like this bypasses open_basedir? This should not work correct?

 

I'm running PHP 5.3.16 on linux kernel 2.4.

[Christian F.]

I'd use built in PHP functionality, namely file_get_contents (). No need to invoke a shell command for something like this.

[kicken]

open_basedir is a PHP setting, and as such only has an effect on PHP's functions.  When you run an external program that program is not subject to the same limitations as PHP is.

 

[kenw232]

open_basedir is a PHP setting, and as such only has an effect on PHP's functions. When you run an external program that program is not subject to the same limitations as PHP is.

 

Thanks. That clears it up.