how secure is this?

[jackvull]

Is this a secure enough way to run this command?
I am worried that if someone could get into the database they might inject some SQL or linux system commands into the database so that when I pull the user and passwd across, an alternative command could be run:

exec("/usr/bin/htpasswd -b /etc/myservice/service_passwd ".escapeshellcmd($row[0])." ".escapeshellcmd($row[1]));

[WesleyC]

What type of data is stored in your database? If it's sensitive, then you're pretty much sunk if anyone manages to get access to it anyway--you'll need to target your security at preventing people from accessing the DB instead of preventing people with access to the DB from damaging the system.

[jackvull]

Not sensitive in the sense that it's not credit card details, etc.
Problem is I have a webserver running on a remote machine with mysql databases that are hidden from the public.

However, I have another machine that I need to provide proxy access on...a different server so I need to drag usernames from the remote database.

I therefore created a public MySql database but it only has one table in it with usernames. I realise this is slightly insecure but I have no alternative. So, whilst I can run security checks on this database I also need to escape the input in case someone puts SQL injection into it.

[jackvull]

any ideas?

[eelixduppy]

As a fail-safe you can enable PHP's safe mode directive and then only things within the execution directory are executable, so an intruder would not have complete access to the server. Just another option to look at for added security.