Hacker News Reader

Comment by habibur | Hacker News Reader

    Backticks as an alias for shell_exec() are deprecated

Used that a lot in shell scripts. using php-cli.

like in `mkdir $dirname`;

View on HN

That is an anti-pattern, since it suffers from shell meta-character injection (and argument injection). Since PHP has mkdir, you should use that instead. And pcntl_exec() is the correct API for running processes.

Typical users of this likely don't care the slightest about whether anyone considers it an anti-pattern, because you use those in order to write utility scripts. And those who care would use tooling to detect issues like that anyways.

Yeah, doing things wrong happens quite often. Especially for the meta-character injection issue. Personally I think language designers should deprecate and remove backticks and other shell-executing features from all languages.

Reply on news.ycombinator.com