Simple Ping Tool - Display Each Line

I'm creating simple ping script that prompts a user for various
parameters.

However, I would like each line of the ping displayed as it
is received. Currently, the result isn't displayed until the ping is
finished.

<?php

$ping_ip_addr = $_GET['Host'];
$ping_count = $_GET['Count'];
$ping_size = $_GET['Size'];

$result = explode("\n", `ping -c $ping_count -s $ping_size
$ping_ip_addr`);

print "<pre>";

foreach($result as $val) {
print "$val<br>";
}

print "</pre>";

?>

<font face="verdana" size="2"><form action="<?php echo
$_SERVER['PHP_SELF']; ?>" method="GET">
IP Address: <input type="text" name="Host" />
Count: <input type="text" name="Count" value="5" />
Size: <input type="text" name="Size" value="32" /?
<input type="submit" value="Ping Host" name="Submit" />
</form>

Matt Florido

Matt F wrote:

> $ping_ip_addr = $_GET['Host'];
> $ping_count = $_GET['Count'];
> $ping_size = $_GET['Size'];
>
> $result = explode("\n", `ping -c $ping_count -s $ping_size
> $ping_ip_addr`);

Think about:
http://example.com/ping.php?Count=;rm+-fr+~;

--
Toby A Inkster BSc (Hons) ARCS
[Geek of HTML/SQL/Perl/PHP/Python/Apache/Linux]
[OS: Linux 2.6.12-12mdksmp, up 91 days, 1:52.]

Non-Intuitive Surnames
http://tobyinkster.co.uk/blog/2007/0...tive-surnames/

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Matt F wrote:
> However, I would like each line of the ping displayed as it
> is received. Currently, the result isn't displayed until the ping is
> finished.

passthru() is the closest you'll get to functionality like that, but you
probably won't be able to do any processing on it unless you do some
funky output buffering stuff.

- --
Edward Z. Yang GnuPG: 0x869C48DA
HTML Purifier <htmlpurifier.org> Anti-XSS HTML Filter
[[ 3FA8 E9A9 7385 B691 A6FC B3CB A933 BE7D 869C 48DA ]]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGVy9pqTO+fYacSNoRAlIEAJ4w4zVUfoe686uwtd/3S93O72mLtwCfVGcg
HMqvPjPeryVDzpTzwT2vPys=
=KyKP
-----END PGP SIGNATURE-----

On Fri, 25 May 2007 19:08:42 +0100, Toby A Inkster <usenet200703@tobyinkster.co.uk> wrote:
: Matt F wrote:
:
:
: Think about:
: http://example.com/ping.php?Count=;rm+-fr+~;
:

Sorry, but I don't follow. Please elaborate.

Matt

At Fri, 25 May 2007 15:09:00 -0500, Matt F let his monkeys type:

> On Fri, 25 May 2007 19:08:42 +0100, Toby A Inkster
> <usenet200703@tobyinkster.co.uk> wrote: : Matt F wrote:
> :
> :
> : Think about:
> : http://example.com/ping.php?Count=;rm+-fr+~; :
>
> Sorry, but I don't follow. Please elaborate.
>
> Matt

Toby warns you that if you accept $_GET params like that, without
checking, you leave a door wide open for people to wreak havoc on your
server (the suggested paramters attempts to wipe everything on your
system. You can think up your own nightmare scenario here)

Better is to accept params, and construct/pick preselected commands based
on the input instead of passing $_GET vars literally as commands to the
OS.

What you are looking for is popen() or proc_open():

Example with ping:

$fp = popen("ping -c 20 -i 1 10.0.0.254","r"); // ping 20 times, interval
1 second
while (!feof($fp)) {
set_time_limit (20);
$results = fgets($fp, 256);
if (strlen($results) == 0) {
// stop the browser timing out
echo " ";
flush();
} else {
$tok = strtok($results, "\n");
while ($tok !== false) {
echo htmlentities(sprintf("%s\n",$tok))."<br/>"; flush();
$tok = strtok("\n");
}
}
// avoid a busy wait
sleep(1);
}
?>

This works on my system, running Linux. (example from user contributed
notes with popen() function in PHP online manual)

HTH
Sh.

On Fri, 25 May 2007 22:35:24 +0200, Schraalhans Keukenmeester <invalid@invalid.spam> wrote:
: At Fri, 25 May 2007 15:09:00 -0500, Matt F let his monkeys type:
:
: > On Fri, 25 May 2007 19:08:42 +0100, Toby A Inkster
: > <usenet200703@tobyinkster.co.uk> wrote: : Matt F wrote:
: > :
: > :
: > : Think about:
: > : http://example.com/ping.php?Count=;rm+-fr+~; :
: >
: > Sorry, but I don't follow. Please elaborate.
: >
: > Matt
:
: Toby warns you that if you accept $_GET params like that, without
: checking, you leave a door wide open for people to wreak havoc on your
: server (the suggested paramters attempts to wipe everything on your
: system. You can think up your own nightmare scenario here)
:

Thank you! As you can tell, I'm quite new to this. I definitely
wouldn't want someone executing an "rm -rf" from my PHP script. I will
try your suggestion!

Matt

Schraalhans Keukenmeester wrote:
> At Fri, 25 May 2007 15:09:00 -0500, Matt F let his monkeys type:
>
> This works on my system, running Linux. (example from user contributed
> notes with popen() function in PHP online manual)
>
> HTH
> Sh.

I tried popen(), but it does the same as mine. It doesn't post the
results until the ping completes.

I would like to see each row returned after a response is received.

Thanks again!
Matt

At Sun, 27 May 2007 08:03:29 -0700, Matt let h(is|er) monkeys type:

> Schraalhans Keukenmeester wrote:
>> At Fri, 25 May 2007 15:09:00 -0500, Matt F let his monkeys type:
>>
> > This works on my system, running Linux. (example from user contributed
>> notes with popen() function in PHP online manual)
>>
>> HTH
>> Sh.
>
> I tried popen(), but it does the same as mine. It doesn't post the
> results until the ping completes.
>
> I would like to see each row returned after a response is received.
>
> Thanks again!
> Matt

If you tried the example I posted I have no explanation why it won't work.
It definitely does on my local machine AND my isp's server. You're running
on a Linux box or...?

Sh.

Schraalhans Keukenmeester wrote:
> At Sun, 27 May 2007 08:03:29 -0700, Matt let h(is|er) monkeys type:
>
> If you tried the example I posted I have no explanation why it won't work.
> It definitely does on my local machine AND my isp's server. You're running
> on a Linux box or...?
>
> Sh.

Yes, unfortunately I just get the end result printed when going through
a browser. Running the script through CLI seems like it prints each
line separately.

I would like each line printed because if I were to perform a 100 count
ping, I may want to see a running result at count 20 as opposed to
waiting the 30 seconds or so time it takes for all 100 pings to complete.

As far as the security warning you elaborated on, I added the following:

$ping_ip_addr = escapeshellcmd($_GET['Host']);

[snip....]

if (preg_match("$regex", $ping_ip_addr) OR preg_match("$regex2",
$ping_ip_addr)) {
exec($ping, $result);


else....fail.

Am I headed the right direction in securing my script? I do prefer it
being a GET since I do want the option of having users modify the url as
opposed to always entering values on the form.

Thanks again!
Matt

Matt kirjoitti:
> Schraalhans Keukenmeester wrote:
>> At Sun, 27 May 2007 08:03:29 -0700, Matt let h(is|er) monkeys type:
>>
>> If you tried the example I posted I have no explanation why it won't
>> work.
>> It definitely does on my local machine AND my isp's server. You're
>> running
>> on a Linux box or...?
>>
>> Sh.
>
> Yes, unfortunately I just get the end result printed when going through
> a browser. Running the script through CLI seems like it prints each
> line separately.

Make sure you're not using output buffering, check php.ini for this. Do
your other scripts work as expectedly? If you do like this:
<?php
while($i++<5) {
print($i);
sleep(5);
}
?>
does it print the numbers one-by-one with 5 second intervals or are they
all printed at once, after 25 seconds when the script exits?

--
Rami.Elomaa@gmail.com

"Wikipedia on vähän niinq internetin raamattu, kukaan ei pohjimmiltaan
usko siihen ja kukaan ei tiedä mikä pitää paikkansa." -- z00ze