Calling Perl script from PHP and passing in variables, while also using variablized perl script name

Question

I normally call perl scripts from PHP as below and pass in variables this way, and it works fine, however now I am building a component for re-use where I want to also variablize the perl script name that I am passing in and this is giving me some headaches, so I am wondering if anyone can point out a better way to do this as my way isn't working.. thanks..

the way that works without variablized perl filename:

$file = "/var/www/other_scripts/perl/apps/perlscript.pl $var1 $var2 $var3 $var4";
ob_start();
passthru($file);
$perlreturn = ob_get_contents();
ob_end_clean();

My attempt to variablize the perl filename that doesn't seem to be working for me, you can see in the above how it is including even the $var(s) in the initial " ", which I find odd but this seems to be the only way that it works and I wasn't sure how to even replicate this with a variablized perl filename:

$perlscript_file = "/var/www/other_scripts/perl/apps/" . $perlscript .".pl";

$file = $perlscript_file . $var1 . $var2  .$var3 . $var4;
ob_start();
passthru($file);
$perlreturn = ob_get_contents();
ob_end_clean();

Answer 1

Your way is not working because you are concatenating all the parameters without spaces, effectively making them one parameter.

Try

$perlscript_file = "/var/www/other_scripts/perl/apps/$perlscript.pl $var1 $var2 $var3 $var4";

By the way, if the parameters are coming from an external source, you MUST sanitize them using escapeshellarg(). The same goes for $perlscript - if it comes from an external source or even user input, do a escapeshellcmd() on it.