Prevention

System commands

• avoid executing system commands and use the in-built functions of the back-end language.
  • there are secure implementations in PHP (fsockopen for os.ping)
• validate and sanitize the user input on the back-end before using in system commands

Input validation

• input validation should be done both on the front-end and on the back-end.
• ensure it matches the expected format for the input, such that the request is denied if it does not match

Input Sanitization

$ip = preg_replace('/[^A-Za-z0-9.]/', '', $_GET['ip']);

- replace chars by empty chars

Server Configuration

•