What is OS command injection and how does it occur?

User input is dropped into a shell command, so shell metacharacters (;, |, &) let the attacker tack on extra commands the app never meant to run.

* One metacharacter splits one command into two — the shell cannot tell the developer's text from the user's. *

OS command injection happens when applications build and execute system commands that include user input.

Vulnerable PHP code:

$file = $_GET['filename'];
system("rm $file");

Attack: Set filename to goodParam; bad.exe;

Executed command:

rm goodParam; bad.exe;

This deletes the file AND executes bad.exe.

Prevention:

• Avoid system calls with user input entirely
• Use allowlists for permitted commands/parameters
• Escape shell metacharacters (;, |, &, $, `)
• Use language APIs instead of shell commands (e.g., unlink() instead of system("rm ..."))

Go deeper:

• PortSwigger — OS command injection — metacharacters, blind detection, prevention, with labs.