title: PHP shell_exec - Is it ever safe?
body: <p>I'm thinking about the different ways to implement a diff. It's either I can write a wdiff from scratch in PHP, or I can simply run a <a href="http://php.net/shell_exec" rel="nofollow"><code>shell_exex()</code></a> on wdiff with two files return the string, parse it's tokens and replace appropriately. I'm just worried about the safety of allowing code to be executed on the shell like I have explained. Assume all strings that would be passed to <code>wdiff</code> would be user input that cannot be trusted under any circumctance.</p>
  
  <p>Now, I know I can use libraries such as FineDiff, but honestly I would rather use the UNIX native wdiff, but am worried that shell_exec will ALWAYS be vulnerable to arbitrary code injection, shell code executing, etc. Is it safe to use?</p>