Invalid JSON with json_encode and shell_exec

Question

I'm using Symfony's console component to write some command line tools, one of which uses WP-CLI to set up a WordPress site. Specifically using wp option update I'm running into issues with both JSON and quotes.

For example, running something like:

shell_exec("wp option update blogdescription ''");

Results in literal '' in the database. In fact, any time I use that command, if it's successful, whatever I've tried to set in the database is wrapped in the single quotes.

And then something like this:

$github_updater_args = [
            'github_access_token'=>'',
            'bitbucket_username'=>'username',
            'bitbucket_password'=>'password',
            'all-in-one-seo-populate-keywords'=>'1'
];
$github_updater_args = json_encode($github_updater_args);
var_dump($github_updater_args);
shell_exec("wp option update github_updater '$github_updater_args' --format=json");

The dump results in:

string(200) "{"github_access_token":"","bitbucket_username":"devs@webspecdesign.com","bitbucket_password":"xxxxxxxxx","webspec-design-wordpress-core":"1","all-in-one-seo-populate-keywords":"1","webspec-smtp":"1"}"

Which is valid JSON, but the wp command resulted in the following:

Error: Invalid JSON: '{github_access_token:,bitbucket_username:username,bitbucket_password:password,all-in-one-seo-populate-keywords:1}'

You'll notice the quotes have been stripped out, which I assume is what it's complaining about? Or is that just how it dumps out the error?

Either way, I then decided I would hardcode the JSON, so just:

shell_exec('wp option update github_updater \'{"github_access_token": "", "bitbucket_username": "username", "bitbucket_password": "password"}\' --format=json');

Which gave me the following error:

Error: Too many positional arguments: , bitbucket_username: username, bitbucket_password: password}'

I wager the two issues are related. I thought maybe it was a WP-CLI issue, so I opened an issue there, but it was closed without reaching an answer. The more I stare at it, however, the more I think it might by a Symfony thing. Perhaps I definitely need to use the Process Component rather than shell_exec? Is that what it's designed for?

Update: Tried the Symfony Process Component:

$process = new Process("wp option update blogdescription ''");
$process->run();

Still got my two quotes. So nothing doing there.

Answer 1

You are looking for escapeshellarg() to escape your json data. escapeshellcmd() is for sanitizing an entire command, not a single argument. Try something like this:

$github_updater_args = [
    'github_access_token'=>'',
    'bitbucket_username'=>'username',
    'bitbucket_password'=>'password',
    'all-in-one-seo-populate-keywords'=>'1'
];
$github_updater_args = json_encode($github_updater_args);
$cmd = sprintf("wp option update github_updater %s --format=json", escapeshellarg($github_updater_args));
shell_exec($cmd);

Edit

There is something missing from your question or there is a bug in the CLI script you are executing. I wrote two quick test php scripts to illustrate that the json escaping works correctly.

test.php

<?php

$github_updater_args = [
    'github_access_token'=>'',
    'bitbucket_username'=>'username',
    'bitbucket_password'=>'password',
    'all-in-one-seo-populate-keywords'=>'1'
];
$github_updater_args = json_encode($github_updater_args);
$cmd = sprintf("php j.php %s", escapeshellarg($github_updater_args));
echo shell_exec($cmd);
echo PHP_EOL;

j.php

<?php

var_dump(json_decode($argv[1]));

output

~$ php test.php
object(stdClass)#1 (4) {
  ["github_access_token"]=>
  string(0) ""
  ["bitbucket_username"]=>
  string(8) "username"
  ["bitbucket_password"]=>
  string(8) "password"
  ["all-in-one-seo-populate-keywords"]=>
  string(1) "1"
}