escapeshellarg() has been disabled for security reasons

Question

When I want to upload anything in any form I see the Warning: escapeshellarg() has been disabled for security reasons message on my site. What can I do to fix this?

My framework is codeigniter final version.

Here is the full warning:

A PHP Error was encountered

Severity: Warning

Message: escapeshellarg() has been disabled for security reasons

Filename: libraries/Upload.php

Answer 1

The @ operator will silence any PHP errors the function could raise. You should never use it!

Solutions:

1. Remove the escapeshellarg string from the disable_functions in php.ini file

2. Ask your host provider to remove Remove the escapeshellarg string from the disable_functions in php.ini file if you don't have an access to the php.ini file

3. make your own escapeshellarg. The function only escapes any single quotes in the given string and then adds single quotes around it.

   function my_escapeshellarg($input)
   {
       $input = str_replace('\'', '\\\'', $input);
       return '\''.$input.'\'';
   }
   

   and do something like this:

   // $cmd = 'file --brief --mime ' . escapeshellarg($file['tmp_name']) . ' 2>&1';
   $cmd = 'file --brief --mime ' . my_escapeshellarg($file['tmp_name']) . ' 2>&1';
   

   But what is best is to extend the Upload.php library and override the _file_mime_type function instead of changing on the core of CodeIgniter so that you will not lose it if you ever want to update CodeIgniter.

   Helpful links: https://www.codeigniter.com/user_guide/general/core_classes.html

Answer 2

Try

$cmd = 'file --brief --mime ' . @escapeshellarg($file['tmp_name']) . ' 2>&1';

Open Upload.php file from system/libraries folder and put @ in front of escapeshellarg($file['tmp_name']) at line 1066 and second thing upload this file under application/libraries folder that will be better, other wise no problem, you can replace system's Upload.php file.

Answer 3

1. Remove the escapeshellarg string from the disable_functions at php.ini* file

2. Ask your hosting provider to remove the string above if you don't have an access to the php.ini* file

3. Change hosting provider which allows the running of the escapeshellarg function.

from this website: http://www.2by2host.com/articles/php-errors-faq/disabled_escapeshellarg/