On Thu, 14 Nov 2002, c jones wrote: >I have found the line below in an sh cgi program, and believe I can >pass a command to the shell but can't seem to get it to work right. [snip] >ua=`echo "$HTTP_USER_AGENT" | sed "s#\;##g"` The quotes around HTTP_USER_AGENT prevent any "chained commands", e.g. 'Mozilla 6; rm -rf /'. Perhaps you're confusing the backticks; they execute the line given in the script, not the result of the 'echo ...; sed'. I don't see any way here to manipulate the input to execute arbitrary code. Cheers, Phil
This archive was generated by hypermail 2b30 : Sat Nov 16 2002 - 01:13:57 PST