Rule Definition
The software constructs all or part of an command via user-controllable inputs. These inputs are not neutralized or are incorrectly neutralized. As a consequence, the OS command may be completely altered.

Remediation
Use escapeshellcmd to escape user input.

Violation Code Sample

<?php

$command = $_GET["command"];

runCode($command);

function runCode(string $command) {
    exec($command);                  // VIOLATION
}

Fixed Code Sample

<?php

$command = $_GET["command"];
$command = escapeshellcmd($command);   // ESCAPE SPECIAL CHARACTERS

runCode($command);

function runCode(string $command) {
    exec($command);                    // FIXED
}

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') https://cwe.mitre.org/data/definitions/78.html Open Web Application Security Project (OWASP) https://www.owasp.org/index.php/Top_10-2017_A1-Injection OWASP Top Ten 2021 Category A03:2021 - Injection https://owasp.org/Top10/A03_2021-Injection/