Question

I’ve written a web application that makes use of exec() in order to run an external program. The program path is configurable and can be expected to have spaces on its name. As we all know, the Windows command prompt accepts spaces in file names or parameteres, you just have to double quote them:

C:\>C:\Archivos de programa\GraphicsMagick-1.3.12-Q16\gm.exe
"C:\Archivos" no se reconoce como un comando interno o externo,
programa o archivo por lotes ejecutable.

C:\>"C:\Archivos de programa\GraphicsMagick-1.3.12-Q16\gm.exe"
GraphicsMagick 1.3.12 2010-03-08 Q16 http://www.GraphicsMagick.org/

So far so good. The issue I’m facing is the usage of the exec() PHP function itself. Certain Windows servers require that you enclose the full command (program + arguments) in double quotes:

exec('""C:\Archivos de programa\GraphicsMagick-1.3.12-Q16\gm.exe" version"');

… and other Windows servers require not to use double quotes:

exec('"C:\Archivos de programa\GraphicsMagick-1.3.12-Q16\gm.exe" version');

I can read the PHP_OS constant to detect whether the server runs Windows but I don’t know what’s the rule behind the quotes or not quotes subject. It if’s explained in the PHP manual I cannot find it.

Is is possible to determine programmatically if quotes are needed so I don’t need to configure manually each instance of the application?

Update #1: I was being misunderstood so I’ve reworded parts of the question to make it more clear.

Update #2: I found a comment in the PHP manual that explains the exact reason why extra quotes are needed (PHP issues an internal call to cmd /c). I still don’t know why this appears to be true or false depending on the system.

Answer 1

I’ve written this quick and dirty workaround:

<?php

class Thumb{
    const GM_PATH = 'C:\\Archivos de programa\\GraphicsMagick-1.3.12-Q16\\gm.exe';

    /**
     * Quote full command if required by server (program + arguments)
     */
    private static function quoteFullCommand($command){
        // Test only once per script
        static $extra_quotes_required=NULL;

        if( is_null($extra_quotes_required) ){
            if(PHP_OS=='WINNT'){
                // This call will be correct (0) if and only if the server requires extra quotes
                exec('""sort" /?"', $output, $return);
                $extra_quotes_required = $return==0;
            }else{
                $extra_quotes_required = FALSE;
            }
        }
        if($extra_quotes_required){
            $command = '"' . $command . '"';
        }

        return $command;
    }


    /**
     * Return output from "gm version"
     */
    public static function graphicsMagickVersion(){
        $command = escapeshellarg(self::GM_PATH) . ' version ';
        $command = self::quoteFullCommand($command);
        exec($command, $output, $return);

        return trim(implode(PHP_EOL, $output));
    }
}

However, it’d be way better to predict it from PHP version or server OS so links to documentation or further tips are welcome.

Update: I’ve had a look at the piece of PHP source code that takes care of running external commands in Windows:

http://svn.php.net/viewvc/php/php-src/trunk/TSRM/tsrm_win32.c

The following line adds the extra comas to the full command:

sprintf(cmd, "%s /c \"%s\"", TWG(comspec), command); 

According to the file history, that line was first added on 29th May 2008 (r260429):

MFH: Fix bug when command is quoted
and parameters are quoted during call
to exec, the result is that cmd.exe /c
strips the first and last quote.

The following PHP releases were 5.3.0 and 5.2.7 but the line is in the 5_3 branch and not in the 5_2 one. I’m not familiar enough with PHP development process so I can’t find the changelog or tell out to which exact PHP releases the fix was ported to but I’d dare say that it was a bug in PHP and it was fixed in PHP/5.3.0 (yet it wasn’t backported to 5.2 so they didn’t break legacy stuff).

So my workaround is probably overkill. You just need to test the PHP OS and version:

if( PHP_OS=='WINNT' && version_compare(PHP_VERSION, '5.3.0', '<') ){
   $command = $command = '"' . $command . '"';
}