title: Security vulnerability with exec(), shell_exec(), curl_exec()
body: <p>Occasionally, I use exec(), shell_exec(), and curl_exec().  Below are typical uses.  Assume that where ever I have a PHP variable in them (i.e. $html in the first one), there is a chance that the user has the ability to modify its content.</p>
  
  <p>What should I be concerned about from a security vulnerability perspective?  Is escapeshellcmd() and escapeshellarg() the answer, and if so where should it be used?</p>
  
  <pre><code>$cmd='echo "html + '.$html.'" | htmldoc --format pdf &gt; '.$filename;
  $cmd='/usr/bin/convert '.$docs.' '.$filename;
  $cmd='HOME='.$dir.'; /usr/bin/libreoffice3.5 --headless -convert-to pdf --outdir '.$dir.' '.$file_org;
  $cmd='wget -O '.$file_org.' "'.$url.'"';
  $cmd='/opt/wkhtmltopdf/bin/wkhtmltopdf "'.$url.'" '.$paramaters;
  $cmd='/usr/bin/php -q '.$worker.' '.$session_id.' &gt;/dev/null &amp;';
  exec($cmd);
  
  $cmd='sendfax -n -m -w -i '.$id.' -o JohnDoe -D -S "hello@gmail.net" -s "us-leg" -f "'.$from.'" -d "'.$to.'" '.$doc_list;
  $cmd = "faxstat -s | grep \"^$jid \"";
  $output = shell_exec($cmd);
  
  $ch = curl_init();
  curl_setopt($ch,CURLOPT_URL,$url);
  curl_setopt($ch, CURLOPT_USERAGENT, $_GET['user_agent'] ? $_GET['user_agent'] : $_SERVER['HTTP_USER_AGENT'] );
  curl_setopt($ch,CURLOPT_POSTFIELDS,array('aaa'=&gt;$aaa,'bbb'=&gt;$bbb));
  $result = curl_exec($ch);
  </code></pre>