29. OWASP Top 10 Web Vulnerabilities

29.4 A03 Injection: Command Injection

By Ravindra Bagale · Last updated: 27 September 2026

Command injection tevha hoto jevha app user cha input thet operating-system command madhe vaparto.

// vulnerable: pinging a host the user typed
$ip = $_GET['ip'];
system("ping -c 1 " . $ip);

If the attacker sends 8.8.8.8; cat /etc/passwd, the server runs both commands. Fixes: avoid calling the shell; if you must, use safe APIs and strict allow-lists, and escape with escapeshellarg().

$ip = $_GET['ip'];
if (filter_var($ip, FILTER_VALIDATE_IP)) {        // allow only a valid IP
    system("ping -c 1 " . escapeshellarg($ip));
}