Rules / PHP
SHIELD-PHP-004
Command injection via backtick shell operator
What it detects
The backtick execution operator runs a shell command containing a variable.
How to fix
Do not use backtick execution with variables; validate input and use escapeshellarg.
Vulnerable — Shield flags thisdns.php
<?php
// DNS lookup — vulnerable: variable interpolated into backtick execution
$domain = $_GET['domain'];
$records = `dig +short $domain`;
echo "<pre>" . htmlspecialchars($records, ENT_QUOTES) . "</pre>";
Fixed — scans cleandns.php
<?php
// Validate first, then use a native API instead of the backtick operator
$domain = filter_var($_GET['domain'] ?? '', FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME);
if ($domain === false) {
exit('Invalid domain');
}
$records = dns_get_record($domain, DNS_A);
echo json_encode($records);
Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PHP-004, the fixed one does not.