escapeshellarg() has been disabled for security reasons

Question

When I want to upload anything in any form I see the Warning: escapeshellarg() has been disabled for security reasons message on my site. What can I do to fix this?

My framework is codeigniter final version.

Here is the full warning:

A PHP Error was encountered

Severity: Warning

Message: escapeshellarg() has been disabled for security reasons

Filename: libraries/Upload.php

Answer 1

The @ operator will silence any PHP errors the function could raise. You should never use it!

Solutions:

1. Remove the escapeshellarg string from the disable_functions in php.ini file

2. Ask your host provider to remove Remove the escapeshellarg string from the disable_functions in php.ini file if you don't have an access to the php.ini file

3. make your own escapeshellarg. The function only escapes any single quotes in the given string and then adds single quotes around it.

   function my_escapeshellarg($input)
   {
       $input = str_replace('\'', '\\\'', $input);
       return '\''.$input.'\'';
   }
   

   and do something like this:

   // $cmd = 'file --brief --mime ' . escapeshellarg($file['tmp_name']) . ' 2>&1';
   $cmd = 'file --brief --mime ' . my_escapeshellarg($file['tmp_name']) . ' 2>&1';
   

   But what is best is to extend the Upload.php library and override the _file_mime_type function instead of changing on the core of CodeIgniter so that you will not lose it if you ever want to update CodeIgniter.

   Helpful links: https://www.codeigniter.com/user_guide/general/core_classes.html